Extracted

• • Target

    file.exe

  • Size

    2.4MB

  • MD5

    5822501defeaba5c16980f624a6055ac

  • SHA1

    afe6ad1d05d03196bfc481d4b0e88c8e3fbfae5e

  • SHA256

    4432a90f67c985a48c470e7b04d59728a766818bf0237b0bc40c0b9837768bef

  • SHA512

    722f3d6bc96d722618951da637412ee53f45f703cc81244eac8dc1051f34a23f5c95a9598f7a4727d11ffb93b514364fc82e4ca12cf2a51ddba789358009a7d5

  • SSDEEP

    49152:z9b2lFsaTG3exSTiJfgst2CTRbZw2yUZp7s0HN0eUNKwiFEud:z9b2lFsaUiJ72EDwgZpnHN5xwiFhd

  Score

  10^/10

  redline1310infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2