Extracted

• • Target

    737307862171267fd72a88c78c79ba14.exe

  • Size

    382KB

  • MD5

    737307862171267fd72a88c78c79ba14

  • SHA1

    9576e06d485497f9aacb25fc6820281e50b82350

  • SHA256

    8deda3f9f857a91d1d9b3f420a3d9102a091849696a8f34b91e9413fc954a82f

  • SHA512

    12e9b8d7fa55d2c478988ce4cf5d9bd1ed91a36f2f76938e7edad8b540a1c3dab284b27baf68dec4c898db844d6dfc11132ec44c8c09efc8b5f0869b988fce69

  • SSDEEP

    6144:tFwR799OIQPd+iXhq+RaoIPqg3oHBcw3v9IliGS16dSg:tFO7DOIQPd+iXhq+RPR9IY

  Score

  10^/10

  redlineevasioninfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1behavioral2