Extracted

• • Target

    ee8f361785699fd5abd30af5d7f08f577eeefbd4db2c9bf9a533706e84552be2

  • Size

    751KB

  • MD5

    79686665764c17dea4353a493070a572

  • SHA1

    e0036cb45ee14f14d9de6e6ab2be1c9faddea2ac

  • SHA256

    ee8f361785699fd5abd30af5d7f08f577eeefbd4db2c9bf9a533706e84552be2

  • SHA512

    3f4b595b0dcddc308b7b02f69751cf89b30c4010157be6a5346667ec150a4c8dc2c8601bd145e29234dee4795f5ade0195c4156b8828424dc4b304db4d514d56

  • SSDEEP

    12288:YMrry90UkABAeZDBx2TQ6L/BsauFceqrLhDV+ax3prgKSTWNzSsNRrWtAYk0l:zyMYLBc/HuW1r5VBx3prgPTizRWtA30l

  Score

  10^/10

  redlinedizadiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1