Extracted

• • Target

    51361e9e75a8d055d92c052704a03420811a08f295ca16985f13c5b5db489feb

  • Size

    2.4MB

  • MD5

    46f69539e92ff658ed5037ee0320bab1

  • SHA1

    3b3d4ba743aa43dc61415c6d574cef96d80d6b35

  • SHA256

    51361e9e75a8d055d92c052704a03420811a08f295ca16985f13c5b5db489feb

  • SHA512

    f6e0e766d5facca41b2c476eab4418af46c5f3011ac3b06a92dc9851d22cea1113e704237a1508a8e85ea2febe8852865a5da0a3ba4127079d341a9287d3ad33

  • SSDEEP

    24576:PmPN7Q8pLY0Y55owQXzfIkkP5vZh4ML7gALdKiuXV/skkdjxM3tVtUCCZVLTHrlL:+C8WLQXzfIkkF4QkCxEtVtUCCZVTl37

  Score

  10^/10

  redlineinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2