Extracted

Extracted

• • Target

    656301eac2f3431b400f5b221de7691e95c799e473abf3497fda2b1b1fde752c

  • Size

    765KB

  • MD5

    9d7b85cbfbfbb59d095cffa148f42742

  • SHA1

    f7020942f6b81549abcf8ee87b1618d7fb56e2bc

  • SHA256

    656301eac2f3431b400f5b221de7691e95c799e473abf3497fda2b1b1fde752c

  • SHA512

    c0c31d79b8e489a51997bac0b4ecfbcc0aeba796c99e8cceca22578f85ac471c46f24407d1fe2941f1801b89225558e353ec25f4341dc37bcfdb8641ca0c4aef

  • SSDEEP

    12288:WMrFy90uBVphYYRllwZJZy0dCqNuRkWxq9N5r6mWNOS7GmLi4U1u8:jyjhRlmfZyKQkEWWr6m1U1u8

  Score

  10^/10

  redlinecrypt1dunmdiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1