Extracted

Extracted

• • Target

    1e2802760f0b07c1290456694ebf5423.exe

  • Size

    173KB

  • MD5

    1e2802760f0b07c1290456694ebf5423

  • SHA1

    9a3a72436ac7d49aeedad5b4eae74173cd8dcb41

  • SHA256

    160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2

  • SHA512

    197882aa57c2dba7a827f3d0b04428c9d31c09a184b51a0f4dac9a6d47e6127a02fec195d2ac96d72bd8726917e360c985ea698c55e5b45b065f6b8dd0e19b0f

  • SSDEEP

    3072:7TQnFeJSrE+G7HRT+rnnDdSzOXueSX5xU5vcOdJRY8pvNBGxEYTlzCS/u:75MrER4nnhyOXs5xETdJRY8ZNBGnXu

  Score

  10^/10

  redline@moriwwsinfostealerspywareupxpersistencestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2