Extracted

• • Target
    08351b82ff3f0f7954820a2dc454c73c.exe
  • Size 814KB
  • SHA256 d477322f8d90be3d37d78ab73d97d59e0ae6ca7ac32e2fdefd5668f67cb1fb62
  • MD5 08351b82ff3f0f7954820a2dc454c73c
  • SHA1 8ad1f8ab47fd38e66e83e8d94912cb9507beee97
  • SHA512 26c1e2058ad631b3cafca6c4d6b62092db0fdab60be394c61c153f741b37de1e9d327c1cdc8c6344215f566f3d94b92cb4a7450349d499856e1d09283580f27f
  • SSDEEP 24576:BfLvhthNFbZT1IMYNF+/lHg3cv5//n5EkhEtxbeIee:NTbhNFZ1HTmMvN+khWbeIb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinenewdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2