Extracted

• • Target

    5c26e89aec6aa01ff423ead562a010de523565035992b4b6675747b69ac2e6ad.exe

  • Size

    473KB

  • MD5

    70ac96d1219c3f70b75ffeb5becc1b87

  • SHA1

    a24fef4b70d971c3b23888c3cba62689b851b38d

  • SHA256

    5c26e89aec6aa01ff423ead562a010de523565035992b4b6675747b69ac2e6ad

  • SHA512

    d4a590bd830fa2d9ad86dd4d1251ac4b06e80bf9a7d5e1309cac61d37ae48bdcdf163f82569f20e9a8aee0a8fb5e0bb5df98040467a2764acd3dccb3effc4dc4

  • SSDEEP

    12288:Bh1Fk70TnvjcqvZOKvxwYWprwZXYJvnIPRz3LbiF:jk70TrcUZB5XwrwZmnYz3/e

  Score

  10^/10

  redlinelivetrafficdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables packed with unregistered version of .NET Reactor

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2