Extracted

• • Target

    1fcfd45222bd54b713f9551a7e8637afab5e5474bfe44e6f406b3c292b326335.exe

  • Size

    165KB

  • MD5

    358fd7a024ec262ab65948220065b9c7

  • SHA1

    e4000efe30f2a44d9658a0de8c19ddde72724ecf

  • SHA256

    1fcfd45222bd54b713f9551a7e8637afab5e5474bfe44e6f406b3c292b326335

  • SHA512

    a78b0e9050fb767c1d2e7f4af30da892fd43a5e97c959e72a5898a6e9a661d6843e2cb148eda1548b27a7f499383e7bc66f2a28df737f97b4d00a94219873038

  • SSDEEP

    3072:4gcZX+7+SQr3crc5W2fhICKwpXD/s8ofTdlv+oztppETf3PDbFLEClhQgXKzrA1H:4gccfrc5W2fhUwmm1fQgB1ghHlczh9kc

  Score

  10^/10

  redlinesetupinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2