Extracted

• • Target

    tmp

  • Size

    1.7MB

  • MD5

    2cfd2401d76429aa6d05b25472a94fa0

  • SHA1

    b02ea5190b0ae4b7a76b6adefecf382c65e47ee9

  • SHA256

    4e2d4ba41a2528aee5c5617b9ed01110c0d4be1841ad5b8af440026798cfca76

  • SHA512

    daef2d971e409091321b3813ed28ce37a72842dcfa9eef32b1141b8de1be1c2c9a2a7f1955b8492b21cab40db9dedee2dacc366bea7c83f24284fa29cabd3aef

  • SSDEEP

    24576:Et9DJXz9Dz+Hg0tIUnygszebhWMVfjo3:Eh9Dz+Hh1nM4Wko

  Score

  10^/10

  redline@ytlogsbotinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2