Extracted

• • Target

    c0f594a7b596ae837b66e85288976bfe55077d510d841cdfe41a0e42325f6c6e

  • Size

    316KB

  • MD5

    2ea5f0973fa72e30eee91358042e2ee1

  • SHA1

    444b829ef824a623752343885439dc80274fc43c

  • SHA256

    c0f594a7b596ae837b66e85288976bfe55077d510d841cdfe41a0e42325f6c6e

  • SHA512

    987b30dd3354bc83957b69ba2ad74507b6eca305947c491c4e73d0090ad37cd493935e3fba734127896e26fd475584571bd1e7c20b4ed369d53c3ce5f85f4b4d

  • SSDEEP

    3072:GB6IW25ma0VuPkPZ+yrTdr/1WLhiTa1xisi3AMa6fJxhrJPXTBDBx0xinMJlXZH:/yXFPk5TJALITExisi9JfJPXTN70Qn

  Score

  10^/10

  redline@oleh_psdiscoveryinfostealerspywarestealermicrosoftphishing

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft
  behavioral1behavioral2