Extracted

• • Target

    f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae

  • Size

    217KB

  • MD5

    883749fce20bc27382131894e7f9451d

  • SHA1

    61015691b274bf7f9cc2592d372c11d38219c325

  • SHA256

    f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae

  • SHA512

    d8a3bbdfdb5adf2c67bb1b38d2d05a86ee2aa3caee60fc4af5c256afd11ce8609556e3d7ce50593d933a7d9f3b0aabdfb90a6e3fdcbb101a538404e57dc00230

  • SSDEEP

    3072:cliRSiFzW0qu7b4ee8fwmGzPMWxS+bsqLCX3knb95IcWdXCY9bTAIrFldI0cBxO:cliRSwNveMwTDM4RVCkbSCY9fSC

  Score

  10^/10

  redline@p1infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1