Extracted

Extracted

• • Target

    939127201975aa85223b1e34c69c6da44343362684f550ae3e4a9241fa90dc15

  • Size

    760KB

  • MD5

    3f0fb5207ddca09a04c6a7f9a5d9bf62

  • SHA1

    2c77b39e5db7a6f94ab92e87d945f11e484d73fc

  • SHA256

    939127201975aa85223b1e34c69c6da44343362684f550ae3e4a9241fa90dc15

  • SHA512

    0ba19ae40c48458b23ffb71240c61fe9cec5d2fbe449c9cc541efbf25f59e3ea18e8d11780ecb76b47f7af0a0dfcf00475caefa6f6649f0eb9444d88a68c418c

  • SSDEEP

    12288:KMrQy90oTlfuLzGKFm38R+DldOIrCIRVDbDJFOURN/btZibyfYCShhJCJCX2mN:my/T1ezFFm38oymCgdJFOcSdhhQS2K

  Score

  10^/10

  redlinedusamunderdiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1