Extracted

• • Target
    file.exe
  • Size 365KB
  • SHA256 68ff988170989b1c7fed3a926fbd9ba6dd54fb43f05d03d1f49ad7d84a830cff
  • MD5 4cf7cc220ac7067fb426f142abbc9468
  • SHA1 3de8c3ad3b04a1772e7e22cc0d2eb56295bef4dd
  • SHA512 7d2a66e55dce9ea41623f8f95ac9965600c312bed3cd825a0d02cc3af560b670e21c96244cb35ba2aa12d3ababd14b1cabbeb2d16fcfc2fc6f18b8166d786158
  • SSDEEP 1536:Lrae78zjORCDGwfdCSog01313Ks5gHZKur:hahKyd2n31z5wKur
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  persistenceredlinetexxcollectiondiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2