Extracted

• • Target
    file.exe
  • Size 400KB
  • SHA256 d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
  • MD5 3e3fd9a5d1491021d0458bbfe076304a
  • SHA1 880af1b339ed093f20652de3e71c5c06f4bb8843
  • SHA512 5044a488e803bf4410335ffd9a9d1d2228b25c6472959becc91b9b3912bfd2552dfd4a39c97a40c3be13589b4ad10f75c036dcdb061b2fc01db97797cb64496c
  • SSDEEP 6144:vz3L76bhCDyUXwISmej8dhV6jqq7guo32TSEj9/CJTk637eQfnd58ABD:bHBDZXQmrT6u3uWqnj9CJb7d5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline2-2-2023@discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2