Extracted

Extracted

• • Target

    ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe

  • Size

    492KB

  • MD5

    81d3017db518b0b252fbc291a5c7d992

  • SHA1

    e05a2679511cc7d307c79b3170f9e8baaf87babc

  • SHA256

    ed28743bfc1a8f95a95e5c6fee5597d6961e497413d8e9b3544588ae7484f3f4

  • SHA512

    e9380fad8c17727c692c4c661e473be836010d4d456af7a8bb2999153a3c26735e080fa6274a62d2634b0510ecfe4eb4e656234eca2f4a9a03575d959a9cc6bb

  • SSDEEP

    12288:gOfPr+8CHzhgAOt0AcfAWV5CRbdjNA98wl:hfz+NThghUAWVMRRjNJ

  Score

  10^/10

  redline@cham1ngdiscoveryinfostealerspywarestealercolibribuild1loader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2