Extracted

• • Target

    DDU v18.0.7.4.exe

  • Size

    1.1MB

  • MD5

    4ce869057d2e41bcc32e2d068fea9f3c

  • SHA1

    4b35bde68c49bf24e3c72a666401a74ca5d6b530

  • SHA256

    e3c1b15399636b925a082fb63806b1c42ef09e347bb3f1227bd07c743684ccfa

  • SHA512

    71a63cdc81a44314ba1794b279ae50b2c0d4848116c931c2596b09f552419a6774b836ed84f8318a9984bc67217876e48796d3e8bcde8343110cc254d7d252da

  • SSDEEP

    24576:PVDTk3iXN0xaU7+Aljw02j5Q6Vo4qd1T6wd3lvsV33nsvme:RommD5NklVo4q2wdts33+Z

  Score

  10^/10

  redlinelmdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1