Extracted

• • Target
    file.exe
  • Size 1.8MB
  • SHA256 3aa2686dba9ad329e0e2da3f76a29161bdc6deab36422b5854838e3afd4ea916
  • MD5 186c9341f36ad552a2a17ea9903eab12
  • SHA1 510968658d13c4e872eb6bc359e454c7f6b6dfab
  • SHA512 6d1bea1f62d64b7de20539bc0cb5eacb103d476ab5a9195169f3c175b8aa3be963747561782f677e288224b85b36f421fb155879ba6eee8937e871c624f3e539
  • SSDEEP 49152:V5OO/l4x/kByJ4g3AVm5c3+12bk7vRDB3VwMylYZRr:V5i8W4wAycuQbk1FFwvY/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2