Extracted

• • Target

    tmp

  • Size

    6.4MB

  • MD5

    bfe6f8581cc2b03a87ff176b63e03cf0

  • SHA1

    eb9e15d544af9ec823c5603c5ba7c1692f7e6194

  • SHA256

    32a0b2435282952f78156d2ed8a459fbd2ae7b376a6b80430934d29cab3d33d8

  • SHA512

    80204836e6ae810ba002c0c6a89c0d672435ab6a31002e9283e492053d43c4c06259eb2045c7cbd723119cd2a45857e0dbc179f35973f62da3c417c4419c0e07

  • SSDEEP

    98304:5dn+cBiWwA2A5V5lqDS/XHt1o0tyGK5jCm+pZl+jRwOySBNmP9sDU9p4:50cILAlfvorGK5j7+pZIDt/ml2Us

  Score

  10^/10

  redlinemastif_22infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Blocklisted process makes network request

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2