Extracted

• • Target

    d31d8f638a1cf596bc2bcfb4120d8295604fb22d8d7ea5e0eb5eae4373227343

  • Size

    2.4MB

  • MD5

    7bcf6ba51c4f1b9f629e6e1a2f83301e

  • SHA1

    a5664a4e7837210b52a2784340779b5802811276

  • SHA256

    d31d8f638a1cf596bc2bcfb4120d8295604fb22d8d7ea5e0eb5eae4373227343

  • SHA512

    38069c00d1598b6619f40239c9ca61e26dedfa78a2c13e17180fccf45f330810d0823c2b4c91ae45781a3371f6f186702310c2f953cd6a59f415f1cbfc232b0f

  • SSDEEP

    49152:tm0U3lPa/n6sQ1cppF6ibbVNCTsWNhEMrwsEwenan3T8POZU5PECX1Ka:tm0U3lPaLp0kVNEfhE/FNan3YmZU5PEI

  Score

  10^/10

  redline1310infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1