Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    76KB

  • MD5

    1deaa9be17e8122d78a470f44a58300a

  • SHA1

    984147abf4e9f173eb233e0949d76e45dd77ef8a

  • SHA256

    712f4d08ad4db1fb658d8206cee6a00f4024fd4ef5de8de0dfbe0d98779f9f86

  • SHA512

    9a522a03887c38b16d7a34a08f3e9f4aded39066fc852575659b4320f5bb7e51693e7d5ca1715a6d67118fa7340d97309e5bf5869e2aa2ab63b7f0fed4fa10de

  • SSDEEP

    1536:zcr6SNQrsMB3xVyalA9XbLxEC58dHPonAXBbKaAE2UHu90+E:FSNsJ/Vyaald+dQnAXBbKaAE2UH/+E

  Score

  10^/10

  evasionpersistenceredline[ pro ]infostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2