Extracted

• • Target

    SlackSetup.exe

  • Size

    364KB

  • MD5

    a371421bfe2b541c078fc43b008a4e27

  • SHA1

    f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b

  • SHA256

    b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca

  • SHA512

    653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8

  • SSDEEP

    6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy

  Score

  10^/10

  redline2discoveryinfostealerinfostealer_genericspywarepersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Find unpacked information stealer based on possible SQL query to retrieve broswer data

    Detects infostealer.

    infostealer_generic

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2