Extracted

• • Target

    383734f46f2f29f9111af90cdf9dc3b3e6ea2e23e238a235f46fe487db8cada6.exe

  • Size

    1.0MB

  • MD5

    a8c1c8f015b17efaa454a30f94634177

  • SHA1

    416bacd4cbf6e717ff02d06f92be0586dec5f5fe

  • SHA256

    383734f46f2f29f9111af90cdf9dc3b3e6ea2e23e238a235f46fe487db8cada6

  • SHA512

    6a456e2d7f7d84c4dc21bed1f49312140ce01e99dbb922c26366784fb1a24ae43febad099ecd75858641e71b33dc50360315de074f1906a4a94e0ef51b18e4db

  • SSDEEP

    24576:2JYqTardgOFZz+7N/fcyFGUuCNgvmY4ul8GGQwtDtH4+i+CTjoIBsZTOT:EPqbz+7BfcypgeKl5GHDYBtBsROT

  Score

  10^/10

  redline@dolphinloader_botdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2