Extracted

Extracted

• • Target

    9e5ff49d0c71b34db4e39fc959100fbbd82a49455bbe59593b0150cba4b362e0

  • Size

    520KB

  • MD5

    6e07e357fa5325908d367b1a779b1de5

  • SHA1

    c57aaf7fdab3c303f1d7eb96765ef7215c3baea2

  • SHA256

    9e5ff49d0c71b34db4e39fc959100fbbd82a49455bbe59593b0150cba4b362e0

  • SHA512

    2c5c5f230fad93584169d6e9104473f1334d0946ca47717c39997fe34c2963f29b8d882b3c682fcd861de22c78760dd80e57c4ced8d59a5fde84111e256cd681

  • SSDEEP

    12288:JMrfy90qb2sQaOZTHS+xJh026nGhqhWs0nLXz:SywR/Jw620nn

  Score

  10^/10

  redlinecryptromkadiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1