Extracted

• • Target
    file.exe
  • Size 2.1MB
  • SHA256 a88de17a29eaaaab996f32b4ddb579d5930b7d1f152bfb10018481e2b5612d70
  • MD5 31989a60648d81e2b1692bf5ee6807b7
  • SHA1 3bccd5583b0bb864b1473f43940ca1cdf87142c4
  • SHA512 99b2d0cde5f9f2124842a45851b4273ffb230616568376e3aeebd98dbabf20170e31a622233a23ee0e7de6d1fa0aae70f35a2e790ee89197ba17bbdfdb62ddd6
  • SSDEEP 49152:V5OMhQHLK7nxP07X/cR9iTTt2NEsSB9IVh+0Y:V5wsP0j/cRUvtsEZB9IjY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2