Extracted

• • Target
    cedb8fc0a286ec44b5d3451f06ee954c1c8cca943981e6f5223bf6916af0fb3b
  • Size 509KB
  • SHA256 cedb8fc0a286ec44b5d3451f06ee954c1c8cca943981e6f5223bf6916af0fb3b
  • MD5 98b6ec64d37efa2d1b82037c9cd2c51e
  • SHA1 2bd96489914570b2fe8f5b652166ae2584b8f203
  • SHA512 87c747ca7377cdd18dd0ace74472950946000b9ef62b279ce41daf040a200893c70ea8e476881542e05a72a89a151d4f7755913a2521f431d2fb79951e57f9d7
  • SSDEEP 12288:nW+60nbnuhQJmv0nBRMGJsk7RRFbo2jnqHS:nWV0n4v0n7MGJX3K8c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2