Extracted

• • Target
    383734f46f2f29f9111af90cdf9dc3b3e6ea2e23e238a235f46fe487db8cada6.exe
  • Size 1.0MB
  • SHA256 383734f46f2f29f9111af90cdf9dc3b3e6ea2e23e238a235f46fe487db8cada6
  • MD5 a8c1c8f015b17efaa454a30f94634177
  • SHA1 416bacd4cbf6e717ff02d06f92be0586dec5f5fe
  • SHA512 6a456e2d7f7d84c4dc21bed1f49312140ce01e99dbb922c26366784fb1a24ae43febad099ecd75858641e71b33dc50360315de074f1906a4a94e0ef51b18e4db
  • SSDEEP 24576:2JYqTardgOFZz+7N/fcyFGUuCNgvmY4ul8GGQwtDtH4+i+CTjoIBsZTOT:EPqbz+7BfcypgeKl5GHDYBtBsROT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline@dolphinloader_botdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2