Extracted

• • Target

    file.exe

  • Size

    2.6MB

  • MD5

    65dbc00037c4bcf505a84846e9bb93f8

  • SHA1

    3dcd17569ada7ed8c6eabee2fae6d31d818f6e6c

  • SHA256

    1c07ebd7879852ae7d29e3327feda21fb884b3d797c94183465d332c0c0ab6f1

  • SHA512

    73afb00543e918dc32a1a9afd52f54a690eb51f9be476bff3d5b39b6cd5a5c2259b30ef91d7fe5b81c629f641b2ca290ef2e0c87593576847bb45604b695e847

  • SSDEEP

    24576:bqYcRhuHU/8+2YuY7MOPb/M+SkswdNlWmi/wxPAGLY/r6TH0MTTLYWLgfLml3RuK:mYcHJ/8WZxPqrAUMTTLYWsql39

  Score

  10^/10

  redline1310infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2