Extracted

• • Target

    9f41b5085cd9d174d9f5fdda111c8bf1ffb1c7b4

  • Size

    898KB

  • MD5

    59b4067b2e46f3e782f55c124f85c58e

  • SHA1

    9f41b5085cd9d174d9f5fdda111c8bf1ffb1c7b4

  • SHA256

    091369381ef4de4d6caf614b4e307e84e59e422fdaf7d23feb13762c447909b4

  • SHA512

    88f1850824cab573b07810568f9068bfdda4e949e29139dba3829ecade9ab7c11ea9359e2b78379774a8acbfeea032c6ffba100dec370f7447ec463f939d63d8

  • SSDEEP

    3072:1L1hinzhEGbhWj/hGqHkSwWgEFZqvyXipmS6RIguAg0FujD0Qth7CTEzc:1LezhHE1GqESwBlvyyQ8AOc+tCTAc

  Score

  10^/10

  redline1evasioninfostealerspyware

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2