Extracted

• • Target
    b32a0ffce29ba355413cda01c14d26c0c806dfad1d82f81de95aca62119bfb03
  • Size 2.5MB
  • SHA256 b32a0ffce29ba355413cda01c14d26c0c806dfad1d82f81de95aca62119bfb03
  • MD5 fffa9f082ea374f080b8b6c0ecd1f783
  • SHA1 ba96219c03ed491d72ad39c012c4a08b99b008a2
  • SHA512 86268dec5867cfe6472f06d0af3e64bb1a285de125f9ac0f92b715da38c00c2ebe63068cad08c974ff109fc95fafae065a2af606dff1f9c8c40b0405a3dbb0d1
  • SSDEEP 49152:iSv33iMmmNcwUwO7DsYeVHOpf5hBQj4VY4:iSX91OZwOLsS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2