Extracted

• • Target

    29eec7d98d03a80e5cdb0fe454a1b2b947542551

  • Size

    196KB

  • MD5

    42af18e9c5cb26caaaf2377638674a72

  • SHA1

    29eec7d98d03a80e5cdb0fe454a1b2b947542551

  • SHA256

    52063e34a0d7d8c808fcda8cb6675f539aafa2b704a015ecab670ad607d3b359

  • SHA512

    05c9bffc3f730bb3d0c45ff13a1aafbcee485a87711d56b17ba105a50af3f476841d87690bee21ab2165a05de771407b24641d4cacae3434741c5d3ac349bb16

  • SSDEEP

    3072:gFRfNqaAmTNQ0668lu9vQGX8DYIpDq1JrPZsleruOAg0FujDStSB6irks5N3c:qBfTT9H8lCvQPpDq1JrPlAOX6irF5N3c

  Score

  10^/10

  redline1evasioninfostealerspyware

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2