Extracted

• • Target
    file.exe
  • Size 1.7MB
  • SHA256 19173eda07d948bfc1224f7337d934d3b87d07e8aceba4d63c786b830ce2bf17
  • MD5 37afe0d7356896326b7c66869649be6b
  • SHA1 51d07ccf4a49bb09baba56145a27fc58375c0cf4
  • SHA512 38e86b08732b2ade41396bcc8bc3da278030d7d49b207c574ef960d9b1447874b66a19196c5e101460ffa7310eecdeeb2784b3adbc28ce01c109b5dccb57b3e7
  • SSDEEP 49152:V5ORZ+cyot+fEf46lUX2SwdxLGrZV2fEuD1jRN/02Ajz:V5LcUGaaGrZwfEuD1jRNOz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2