Extracted

• • Target

    da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d

  • Size

    392KB

  • MD5

    89ec2c6bf09ed9a38bd11acb2a41cd1b

  • SHA1

    408549982b687ca8dd5efb0e8b704a374bd8909d

  • SHA256

    da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d

  • SHA512

    c565dbb25dd35ae8dce2a4cf15640053aca8b99c5c78db23648e6618ef316362b77142c6524b47089a7ea05632adee091ec5e82ed95aeb86d2331b8c5f8cc56a

  • SSDEEP

    12288:iSDt4gq9aVLevhc02f0/nndTHh3Ep2a7TL:5Dqg6hcR2ndTZe2a7TL

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2