Extracted

• • Target

    Enquiry.js

  • Size

    4KB

  • MD5

    b7c067e5f15d2264ab945d07589462db

  • SHA1

    9f25636a346d6cbea1b53270e63ac042d0006034

  • SHA256

    3ecba862df8a7e0e278375c4491219dd2022882c8c44870019b497ed45db415a

  • SHA512

    4e2884cf13d1cef7223ef957b338f984b1ea8a2f88cb194d9c32b5d6bc47c4f7b7903ccad13d4aa10ac1fecb8581b01f3a2c10fd9b5e680b9cf5a0e360209aae

  • SSDEEP

    96:IfIr3U6zGVyy5VMiR/cCVomAGmHJxPRICWG7zEz5Lyi0jAKQL4i0jAPq/8HScP:IfIrE6zGVyaM6/cCV6Xu67zEz6fAqEH3

  Score

  10^/10

  redlinedoccinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2