Extracted

• • Target

    Crypto2022.exe

  • Size

    350KB

  • MD5

    35a8a62ef9d13c5c9b4d394116773609

  • SHA1

    78625028c550a8d9d1c7c7aef52ae98c9728f70b

  • SHA256

    a0ac355c321bb962cd3d0825f3caabfd4e6c9fd847d15ca72ce4bffbcf617c23

  • SHA512

    0682e346ddbf6dc27a65db3e1a33c392c4736ab2552d6fcab6d3ee43856dcbe4a75f79977ba7abda23b0a317452f7b72755b4c6e15ea5e242e2b8e01ae16f2ed

  • SSDEEP

    6144:3c1o7hv9QAMuezq0BHH0DBYXmgwC1AOUw5HvxahMo0/63IG3clQem9K23TkRZYVl:3c1od9QAMuezq7FzyaSvcMofXMY9KOIu

  Score

  10^/10

  redlineubivcainfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2