Extracted

• • Target

    ZoomInstaller.exe

  • Size

    5.8MB

  • MD5

    5380a51e5286d9bb51d369aca9b38dc2

  • SHA1

    69c696e0beb957f1030df1031ff43c727cdb0595

  • SHA256

    996c4e5418405912b929e7916def0a6c0aaedf77065ec5725f4782b00fb1464e

  • SHA512

    eac5346d2d9a9f16955b9bf9ea33f2e9932811462b0d7054ee0ae81394b017be4c7124c49555294a22b6f2935790e5054117d3fa647d6dc1860138a2a365dc77

  • SSDEEP

    98304:pXz0TZpDOiYnzJagiZLjfWwYpnUO1CtNC2hEBFiFk1sxzqvL9O/vNl/pEo4ghFk/:VeDrYzJRuWw4UI8CHBEC1fY/X//hi+a

  Score

  10^/10

  pyinstallerredlinezoomdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2