Extracted

• • Target

    5f28e537ea9f681c845e12f5fdb9684d.exe

  • Size

    667KB

  • MD5

    5f28e537ea9f681c845e12f5fdb9684d

  • SHA1

    38cee9d23f5d1e0b11ce8850e8edeca09261f7f2

  • SHA256

    a62a32aaa084cf58502545836b26e682051f67065a17a3b0bc595223e4263d4f

  • SHA512

    a030a25bf6520bb0d69b6cbb29260a202219f6de97131de4030a307160847903b0d4d8ec5984f6a2a25e7ccb369e716188b1bf8e5ad1a309f2139e7386d0586b

  • SSDEEP

    12288:dgG+zzPAELjY7Zrp67eISK745fab5e3TEE:dT+PPh2Fp6qIL45Sb5e3J

  Score

  10^/10

  redlinelyla.22.11discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2