Extracted

• • Target

    21003af880e681549de538ba191670cac43d8430ccf7ab11a8e164f18a3cc8b8.exe

  • Size

    322KB

  • MD5

    9b3689a34c9c5d13c5edd650ee28c36a

  • SHA1

    c74bc3e35030ea98bb87221f5f5ad882b537d146

  • SHA256

    21003af880e681549de538ba191670cac43d8430ccf7ab11a8e164f18a3cc8b8

  • SHA512

    28c697aeaa0772f505921d0a373fb663f72f6bd056d9f2fc91a0d7d8ba93c47ad3e956be502316f20ca9f0bc251254b4b85cb529e4ea6e727091b5e9479b9eb3

  • SSDEEP

    6144:urWjANCz3eSNnGKx/ykVyrcowPkN0rx6lYMfz9I9pkGZP+5nuQggu23kp:QWcN6X1GNwr8NkQlvrC9pkGdInZZu7

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2