Extracted

• • Target
    file.exe
  • Size 1.8MB
  • SHA256 b11d5db5b23557327b0b40d1ea086ec4dc0ce3b52fdf61b3ed1d897016a73a80
  • MD5 06cfcce8c057dfb9fa974c0c39a82b45
  • SHA1 3f447228b122c3c80788af4bb67df66cfeaee947
  • SHA512 d359ac78f6bb0a7c59feccd6b4a222452a5a117738aa8552ccc60e27b7976dc76b664931c30261cba791b84b4a9c0308004e977da26c5a56a1e48c729080522c
  • SSDEEP 24576:0NA3R5drX/W97xfDfQKOuga8luPvup+r4IdEHSTQ/kTNXSqXg6enhgWZEeoor0C5:V5O7Oda8lnp+rHk/YNXJehSeoor8xtqn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2