Extracted

• • Target

    dee9ad32eab4891fb956f119086543a5220518547f24794812f42e012b0cc1d4.exe

  • Size

    518KB

  • MD5

    c15c91c578b84e19b66599a4eaa29636

  • SHA1

    2baf692d598ade6f2348fa5a875857abb70e4ca9

  • SHA256

    dee9ad32eab4891fb956f119086543a5220518547f24794812f42e012b0cc1d4

  • SHA512

    2268017aa29e327707f3471957296056c496c7ba835c6ddca7f4bed59b1882d93bbaab46c9f4ae1c5ab120f9ceda8a4a096566ad37b23103829676c8cf3b7d77

  • SSDEEP

    12288:pbA9s8w7P9Ca47E6uUlVGd7KaL7mTIFc/K9lTdovsC:KsDb4nKwaXmMy/K/Th

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2