Extracted

• • Target

    9b0e09d7ff6b42667e744dd7ee8623a6.exe

  • Size

    660KB

  • MD5

    9b0e09d7ff6b42667e744dd7ee8623a6

  • SHA1

    b7d6cc0c3d04c6ac6e757dadadd59fcffd69fd89

  • SHA256

    05aed5bb6d590c1b0781804889957f73a85aa49c248f0e1c453ffc2777f4d5fb

  • SHA512

    6742fd1c3e1c91ed0361be377f5df52658abde63d9c70f47716c82337673c3993445c94e2cd5325f07257ca975e694bb96cf7e3c2e5b8c438e35b803a74104a2

  • SSDEEP

    6144:e7BzKQRNBVp8iZ0WEpAorPDWpeawdAhrlZlboHdw+eGPNcrW9EE:iBzbXp/0WExrrWpcihrzlboamisEE

  Score

  10^/10

  redlinetop2discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2