Extracted

• • Target

    file.exe

  • Size

    488KB

  • MD5

    b6d1f343014dc55ef2588ca861db518b

  • SHA1

    896f1eb79619be7dcfe3f3b137a59f2ea2712fd7

  • SHA256

    e5e5d8f93c5b2df051962b4aec10d2f75207e6b3113ae85faa2d810ca4bcf616

  • SHA512

    b015c947158b34241a789b15b248e81e7483a69b519b4df0cd99614219debd8bd57fedfc05788ab97c23402a17dac061284aace69a93951dc1edfd686adc2c52

  • SSDEEP

    12288:93re4RXLKXpN3zZ8+A+PbjNHsX+54YzHiegI5pRO0:3RXOXpNVr4+GEHi4U

  Score

  10^/10

  redlineinfostealerlogsdiller cloud (tg: @logsdillabot)discoveryspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2