Extracted

• • Target

    SecuriteInfo.com.IL.Trojan.MSILZilla.23569.19997.15103.exe

  • Size

    7KB

  • MD5

    ea741cefe4cc499c682b9cea7d88c8af

  • SHA1

    06736c7eae5d9c6b0ef7185d42b3227591d9f382

  • SHA256

    ddd2832de9b42fc2b5b4ad51c9db65d979fec3312aaed4b1a31aa439b0598569

  • SHA512

    07bd47d2d5552cfc187e8ce7cdc46ebb133df1065c5402f0903b8b908d824549c29c5d13ca3ed7e10f46fb3f75cd5d7f91307c8b7d7dca3d83070b9fb16f8250

  • SSDEEP

    96:ayiUH8aVYVbJFfrabOk0L3ph+2zIIxOu61gy5jRqzNt:3iWWVtFf4OhL3phJIsOd1l5FM

  Score

  10^/10

  redlinesb9s5ylxvjdiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2