Extracted

• • Target

    tmp

  • Size

    1.5MB

  • MD5

    362b8e049e3ab792eeee6bde4ca2491b

  • SHA1

    e185df4e0e40cf2a68251d18979b21a812c5a545

  • SHA256

    b08a80b3d8ed960304fd66086b3c2cf13745118e04d6db99f9b0ff68b869b4cf

  • SHA512

    7beb758ee55c1c8577fc1a148a50949e48138e2a41681851a3681cbe5077d129e8fa11045bf42dd9cbb22e6b1aaee86a889bc2a04e61b6030892333bf2859643

  • SSDEEP

    24576:QW5V1bZzMgWhLtsYsvkdnddMF2ScVC3oKNVpNXIRf4cvuy4jS:j6hJhXnddG2lCYKTpNXIt

  Score

  10^/10

  redlineyt&team clouddiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2