Extracted

• • Target

    5dcd7c97a2be5d40201865b67b2cefda7c2e9b3a17f86f665d17846d403d4991

  • Size

    315KB

  • MD5

    87811d799c8ef74dec614b987a091fa4

  • SHA1

    6dcb262e77a6395c94f25f78b419469d7263d41c

  • SHA256

    5dcd7c97a2be5d40201865b67b2cefda7c2e9b3a17f86f665d17846d403d4991

  • SHA512

    0719587c53612dc9febfe63aea6a88157c910a26a2343c43feff0ed9bbd97285f93b81003f338d018609e1445ca15b90f204072b0ac031d3d4b529a3aa6839b7

  • SSDEEP

    6144:ru9pI60nbM8uPZy3+8KIDsGu+Ac9GG6TU20aedQwJs1PXHS:q9+60nbnuvGpnmU2g2/HS

  Score

  10^/10

  redline5345987420discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2