Extracted

• • Target

    ef17ce0d061ae883496729fe53a6de7ed6bce650c128a83e48e56d7af45e9ef0

  • Size

    315KB

  • MD5

    feb7a08e104ae7cecadfb62d65f0ea8e

  • SHA1

    9ccaaa903075783c59143fe2f1d38f034fcda969

  • SHA256

    ef17ce0d061ae883496729fe53a6de7ed6bce650c128a83e48e56d7af45e9ef0

  • SHA512

    dce40d8894b079be4e3952e90ea85b58a4e859f09b77e0e032c8ce5564c663be2e39256f074b68e61e456b08bc537d6624bcf0b585355ad9e91520b2a6b02d1b

  • SSDEEP

    6144:YY9pI60nbM8uPZy3+8KIDhou/zI3PQ1fBV101COdCqfNl5oJXHS:79+60nbnuyot21OAqfNlWHS

  Score

  10^/10

  redline5345987420discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2