Extracted

• • Target
    84fa342db3e61b9a30b76763efbbfaea700476a8
  • Size 247KB
  • SHA256 ef977f35deec3d30dceafdc1b9ba117928ce3f78156dfa63596bcdf1d0d81d8b
  • MD5 1eed44b17228fbc5779f5bb908161e73
  • SHA1 84fa342db3e61b9a30b76763efbbfaea700476a8
  • SHA512 3ac850fe79c9f20e2311898f2e9b57a4fc9f45e135b916822105afa00528fc16f73fdf89a7cfdcd020fc4c7f855a12cb8b4dd7b969146fa8e68d104b3b3e4b5a
  • SSDEEP 6144:w93F+3NnZo50r9uMlWr1o1XUQTH3oXx/EAOhxm09nmvc:S4tZo50r9uMlWg1ZrxtnF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline1evasioninfostealerspyware

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2