Extracted

• • Target

    cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

  • Size

    314KB

  • MD5

    d17e839ac938c0fe1b5ae61e458e2879

  • SHA1

    5f5d2368b3c5d91560af9ba4a3dc6a8907c4d81d

  • SHA256

    cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

  • SHA512

    0a3b91c8fbb04aa49716a3fef14e6828376c5004607138b74bc3c422e1dc5e70d7c0d9b4ad56b0d94d3e1d15082ad577922d3d9878741efd01a88d2fc765b261

  • SSDEEP

    6144:l5npI60nbM8uPZy3+8KID1BurfcqslPdDMQ44I1XrZXHS:7n+60nbnuuBcvQp54vNHS

  Score

  10^/10

  redline5637482599discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2