Extracted

Extracted

• • Target

    583d5c6d4e61b20078a64e593604894cab5412213030ad46ad8734173e144404

  • Size

    839KB

  • MD5

    a19c83d2122823f9ed7bf92dd37af9e2

  • SHA1

    52cd94222f7b51b59ded04dc3ad49a23b635602c

  • SHA256

    583d5c6d4e61b20078a64e593604894cab5412213030ad46ad8734173e144404

  • SHA512

    67eb5e199530112dc0a1bf899b0898a42b40482ec5324f3d008b7f992076af56fc6b1bc556aaf55bb800c186a6797b63279b02a07d918c673c0c5e77261fe3f3

  • SSDEEP

    12288:cMrGy90rjw3V0I6meZW70YRJwo7PyHvOwrVet8T9MR/hkNBMX7KtMs+tj57Fl7t4:Kys4JdR6o+POwc6iJh17KtMs+td7FJG

  Score

  10^/10

  redlinecrypt1romkainfostealerpersistencespyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1