Extracted

• • Target

    file.exe

  • Size

    221KB

  • MD5

    d1c6f534ed99e48438b09d519c392d1a

  • SHA1

    9807bd326ac0e7ec154a4a8e1ef0188bcdf29437

  • SHA256

    febb7ca5e46576693b590dd0505fc04f6a1869e8b33710610945f41cdd748ef3

  • SHA512

    e3c31ac9df240005dc5d548cb75f0b02ec5b1a340fb63fd33696e1fde902bfeb8d9d616ebea46f3532340fc0d2202f9ed250e5d487257461cce37e2fdc75e681

  • SSDEEP

    3072:3JYiCnaNgcWhx73J4ziUoGDet/q/1Bfm5CeDQ94/Q:5YPaNgcWL73W+j/QBe5Ts94

  Score

  10^/10

  redlinesq1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2