Extracted

• • Target
    5CFCF21174BE2024EE356D7219BC5C17.exe
  • Size 1.1MB
  • SHA256 cbf7d9a996e468305ef104f80f50d6f6b4208223b199deb8011919e5ce607d9c
  • MD5 5cfcf21174be2024ee356d7219bc5c17
  • SHA1 9bba45f158736e06b9907c008b6fd5a81bd8f0d0
  • SHA512 e80830a87e6cc3cdcf16a225d2c42b7d5e4213bba3e97380734552a4298b245e7f69b94c6fc2f86fe88fa8638ad7145bfe67408fd16e762a7c466739c7a7e68f
  • SSDEEP 24576:9Kf67Ko7B0Q9sNbv3CQg6JZUza/lXYAcLXqSB71qOLtfzQo8:9US97B3UCCJtX85B7Ma1M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineseo2discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2