Extracted

• • Target

    Order SMG 201906 20190816orderGMD#0498366Deta.exe

  • Size

    2.0MB

  • MD5

    c4699c2bdf286700da2e1b824a02ec8e

  • SHA1

    d8c87f86c6704a20898b305c5438de9cace94636

  • SHA256

    0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694

  • SHA512

    2391f5a77716ac5496620efeace5871bb1b7767902053a592b8fd632e84fa1953038cadb185d371b83de67130f0cbbb2d4ce6d69f31926fc1fd51f37f9ee32af

  • SSDEEP

    49152:gB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8PDYWg13pb67sca+gpNeB:AaRrFCIcW7dkK

  Score

  10^/10

  redlinefozdiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2