Extracted

• • Target

    5ceedc9d02e351a9dce95c66b.exe

  • Size

    513KB

  • MD5

    5ceedc9d02e351a9dce95c66b5cd60a0

  • SHA1

    1d8f2eb4ee6f9428cd5d9619550bb9f3bf6608a1

  • SHA256

    caa5a8dfdcc33fc8e9c3f331503a8b4d8ec6302a91dedaa62aff89686c0f6fba

  • SHA512

    037b5dedef7b8e69800c00018ffc8b6bfd16921634ff435a95ff186764d0914de27b39ca88fb663d45ea4370c59e6f813f69cf2c6c86a880524305f3b5a3faef

  • SSDEEP

    6144:dFITir3hRLmBLOY5P3m88BtK3wxHnrj/VaD9QLRom/UruPVIaySvQsqIr8CqgYx0:0W3hgEQ2PBsEUoD5PVIjSl7VzOs09/o

  Score

  10^/10

  redlineandrediscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2