Extracted

• • Target

    PatronLaunch.exe

  • Size

    2.1MB

  • MD5

    ff1d96499dab76405e7a1a36c288bb52

  • SHA1

    35040f2bcb352395548efd8e6ec8a4037ce8a923

  • SHA256

    485dd83e372fa43f118370047bc58c0945df1c6aeed915dcbd666e01ec84ce1e

  • SHA512

    5d6c66f75613ce23709b753150fb8d8cf02ffeb08d226755f00a0aa09d40e60117c5ca69a21ffee11581c0bfd9e3de852446d1ad77a3f6bd710ebcf2da77233d

  • SSDEEP

    24576:3NvgNRDrGA5/pCgaFwXUaUIvJiQ9ecH40F4gMFci4L:p6rp5/pY6kAQQ9ecHn4dyn

  Score

  10^/10

  redline1249754941_99discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2