Extracted

• • Target

    0a786e303e16343093734c16a10c14678a4416db

  • Size

    242KB

  • MD5

    ae79492d0a842ac4baafd9d85fb9bc44

  • SHA1

    0a786e303e16343093734c16a10c14678a4416db

  • SHA256

    5645027ee70163cb9d6aa74b746a93b4129ea32ba6e7c1d1a5552dccc7efa77c

  • SHA512

    98180a27864fcd00abb524e66d3f5e2c3c5257566c0762944112ece92d79a4740f2f03c12e90a7f640a67038d3120096ea282cadf9e2102ded76ed7593997233

  • SSDEEP

    6144:4fRDK77E07tfCXaTxophyratdHHAO91HCNcx9c:ae77E07tfCXLndHCyxG

  Score

  10^/10

  redline1evasioninfostealerspyware

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2