Extracted

• • Target
    2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7.exe
  • Size 301KB
  • SHA256 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
  • MD5 832eb4dc3ed8ceb9a1735bd0c7acaf1b
  • SHA1 b622a406927fbb8f6cd5081bd4455fb831948fca
  • SHA512 3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
  • SSDEEP 3072:xqK8kKqJ0kadS0V8HO4ZrgvsJ8y0IHw9TZJMfPTcZqf7D34VeqiOLCbBO6:QBkKqGF8O4Zrgc8Z9TZWTcZqf7DI/L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinejok123discoveryinfostealermotwphishingspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw
  behavioral1behavioral2