Extracted

• • Target
    741f858f958dbf16c5eba258ebf662a13a028d215fc12aec3eaef0c715bd496a.exe
  • Size 373KB
  • SHA256 741f858f958dbf16c5eba258ebf662a13a028d215fc12aec3eaef0c715bd496a
  • MD5 ce91f8404dc12c587a5bd02ce1079e34
  • SHA1 27882df4f5c0152b8d931f28e1df1608dd385ff9
  • SHA512 fbda65c8b46f3909ed2c3bddb94c088a6ea95ea4fad3f4599700fc35e1c245177903edb7a5ef9939c9403b46f0f050aa1201b87fe092933d663911f0ca9ad9ae
  • SSDEEP 6144:Q2kyf8q+lw7zU4AJAuNMe7OKpfJ1YIVYNE0q8JffQ4FErTrISfI5K3HWjOjXQL7y:Q2wMzUZJQe7fpfJaI2NEgff824qGi7y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline@killerbscinfostealerdiscoveryspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2