Extracted

• • Target
    e7bc120d484a448e194067bc43195d68.exe
  • Size 260KB
  • SHA256 9cf0a5672e9539d3ff90d6365c28f2a8e2ba4c73b86f7eb3665ed8ae394f91c3
  • MD5 e7bc120d484a448e194067bc43195d68
  • SHA1 c72e0e77c4b39ef5c8d5cb689bb59efb4423ed35
  • SHA512 9b16f72120a9eb80f6b56d724e2af1797f14bc2e866c91a941b76f3d20efc3d309232a0840ebfe70b064b29fac87b39925014bd13a90386fdef038b16e279b6b
  • SSDEEP 6144:HvsKZZtTQAnVe6iCYxRX2z7fmwNrI0rE:PsIrRVeZKewNbw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinecrypt_cryptex_v1infostealerspywareupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2