Extracted

• • Target
    file.exe
  • Size 2.1MB
  • SHA256 4be071e41efa58f0914dcbffc7be24b71978e8535c4f04e2dcf6b30375ff8d6d
  • MD5 e46e130a7265538d87ea40c2afafb07b
  • SHA1 6da03c77b78cb0182ed1beb9c3702a70c3c16006
  • SHA512 27c3f65c86f50d896056ec277b58a1788927a27909529b3cd669453b026f027bc0e5dfef703de85db6552391b973ad9c8b3ca320d1df32c10718d03408c49ea9
  • SSDEEP 49152:V5O2dXVCiNXhbqXH6WM4IgtgqPk/t6N0vY4BNvFjW:V5lXCinbqR5LtgqPk/t6OvYoVW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2