Extracted

• • Target
    086cadedfdf7ccdd1ff9405f8bed27d6613c109689fc179ad4aadf55b8b9d266.exe
  • Size 868KB
  • SHA256 086cadedfdf7ccdd1ff9405f8bed27d6613c109689fc179ad4aadf55b8b9d266
  • MD5 3f88d06db6d8266c54d0b69b44a6a690
  • SHA1 9f568daf98d12cc54471e8bf73e0e9e49256283a
  • SHA512 39de185dc8938ed67bdfc90d36b9e50ddb0db5d4358fae52f86b28602e9df46bb8f90427fee4436283cd94b67dc6a9112691b3cea0bb437c0fb56bea5f5a70f0
  • SSDEEP 24576:RNCz6WVnhvvi9X2egunROnuytc1Hi8O3jx8eB4:/QJtch2elzsMC82m
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2