Extracted

• • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXNJTEM0SWxRN0o3Z2t6Z1l3TjJodDBwOTZpQXxBQ3Jtc0trQ1Vzd3hGcm1aaWhOV2hJaWoyQmItNkNyM05wY1h0NUtQNktQZEhBUS1MZklaODctdGRaSUtfNVZ6cVhzbXNVelFHNUFPdGczdEV5UlVjNi1JZXRodFQ2c3NVemtyVzNzenRsQ0E4Q202aXdXM2V6Zw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fhy8zlvfg5fwb1%2FNewInst&v=X55DsZT1v44

  Score

  10^/10

  redlinecredential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery
  behavioral1