Extracted

Extracted

• • Target

    90403b8740e5c78b94f5596bb831f33bdc0db9b6b5098640d09b48128fb4d41f

  • Size

    839KB

  • MD5

    2611a12c1fe8b10468ccd0a729e88052

  • SHA1

    bb1e2fdac2b303d890a58cbeb5caa1d0b62aa7a7

  • SHA256

    90403b8740e5c78b94f5596bb831f33bdc0db9b6b5098640d09b48128fb4d41f

  • SHA512

    49220c6d4212a6d735ade94c605cf8cc6c9e90bb6357dfe357d802c873d9ab10510ab965f126ba1d6aecf5de74b7a86da1aa29b40e17a6f9aead4aff2fde50f0

  • SSDEEP

    12288:FMr0y90X1QXHoyqsOaFZdwU5OgHDU1BO4rO3BLPVngWWKFMzz1zYVAPb2:ByY1QfqbavdwkHwnO4cMW9KzzjK

  Score

  10^/10

  redlinecrypt1dunmdiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1