Extracted

• • Target
    c565f71f426a913c738310198a01654ed930dd09
  • Size 361KB
  • SHA256 b4968767ee9f8c1ae309d7f8a8f4c9cff847a81d46d021608add9de06a4ba965
  • MD5 0d356ea4776618c8018b385e50720061
  • SHA1 c565f71f426a913c738310198a01654ed930dd09
  • SHA512 68a17800b2f2fefb5e5f28c2d1639989361f158c53dcc5e7c6ca49b61e7eabc1343b0e91ca8bdba1febfac33cc92ad84a6daf94acae9abf8470a722a91db7268
  • SSDEEP 6144:/iN9Ozs7npw4ngtJ5kJ+w4UhclWqDzEgvDv8LGB3JBVvidaGExXAO+DzyM7+Hc:/iqzs7nNg35kJ+wJhcgqDzLbvBBxvxXw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasionredline1infostealerspyware

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2