Extracted

• • Target

    7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06

  • Size

    201KB

  • MD5

    25c1edf6b6614bcd7b2bb069ce43da3c

  • SHA1

    3c908bc6da3c488b4db676d7b142714355122dc4

  • SHA256

    7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06

  • SHA512

    fed4eabc05c462bb0b41f8e6748960de036a7664b5055574a0c942ffc54f19752e8de767454f0d127395574e4aa0d8bc2492cd77d23b40ee461937e60c8c8e9f

  • SSDEEP

    6144:A3PNeTr97mhYdrkZ9NdlkPKUFfoYeErysLagemoP4V3L:EVlhZ9Vi5ewy8UQ

  Score

  10^/10

  persistenceredlinemusor1infostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2