Extracted

• • Target

    RIOT BRUTE v.0.7.exe

  • Size

    41.4MB

  • MD5

    78dd0c1b766ac88a465b462969e1e7c1

  • SHA1

    5dca6845eabdbd89bb7cfe30dab8e59b909274b1

  • SHA256

    e755ee8301b3bc79e0aef9dad46b17f5ed7aff12a23986702c53dac1592d0669

  • SHA512

    d6e7563c106f1355389b31ac84697c2926fd43f173f027fa30dec5dca4cd4cee9470e559c2ed34dc47f30809c8ce91ec98b40f05724070eab54d8a3f300cd53f

  • SSDEEP

    786432:EHf+YFT57yO5I27EImKCD0S+F22DPToF/e6Gj4XN4Kzgk3WDsFBhnaHABaUI7d48:EHf+YFMO5tnowBDEF/y4NbBhnFBC3ok

  Score

  10^/10

  redline1871187217_99infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2