Extracted

Extracted

• • Target

    6d34b8942745ad6f90736834a337b8cfe9bd456d3375fac9cb48e95e8fbadcba

  • Size

    890KB

  • MD5

    f9f6563fc8bca6dd7415a2ecc33a29b9

  • SHA1

    d92cbdcbc7780f6b1b8a082914c859f969bb8f7f

  • SHA256

    6d34b8942745ad6f90736834a337b8cfe9bd456d3375fac9cb48e95e8fbadcba

  • SHA512

    7f64b53971a28fd7a9200a7c93784be1d6b4a71e2e1edb8fe98662e840fc421c78c4a0a3094ac814194384c6fb802483ab4b9036099947c591fa82eb72b12b31

  • SSDEEP

    12288:gy90AHl+gOEBRwn3/gecnXcoZTbN5a4N4qptT72hiPTt5Za7AKt5w7+Swihhec:gyHl+t4fznTptTcirDKE7+SBLD

  Score

  10^/10

  redlinedantegenainfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1