Extracted

• • Target

    SynapseBootstrapper.exe

  • Size

    70.0MB

  • MD5

    235974b1df44f0484d8210536dab5d41

  • SHA1

    de52848ea0fedf2f7491e81147139a2d80fe4a6c

  • SHA256

    8b4acf13ad30350adabed9aa814134fe1065aaffeb04b2403b400986859dc19d

  • SHA512

    65202c05e5dd1a04ecdf04b1ec5be0743d26d28a3aa2f376bab057a7b7a253e872d7417b592d525227dd937f1d7541f4a7a2b35654a7b8398065b91484acc9b7

  • SSDEEP

    24576:z9JdpJxPSmAs5RAEZXA9f0dna+oF7uQajj5yr0E:Dd5NT1Q9Kazubj5y4E

  Score

  10^/10

  redline@dxrkl0rdcredential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1