Extracted

• • Target

    9cf3a490991a8c8bf088d3e96258c0a0N.exe

  • Size

    968KB

  • MD5

    9cf3a490991a8c8bf088d3e96258c0a0

  • SHA1

    0579860ae04ccfe20c59f86c99e060c9114179b3

  • SHA256

    b254d9ed08f3a7398fa49ea2b511ba5591c581c6843518048a60569d949dea9c

  • SHA512

    e22e83bab96280aed6b329a4476ed5d24536a1f3eb662583bf32509868bb9523a4309e58a4f73528305285e7d8d1d5a566cd9207b167c1291f4dc3de1a978694

  • SSDEEP

    12288:JXCeCOfdk+VhmheZCVtqO9bES8zOFHKPJi4/ubnYLlJ6Gug2tV3:PCMdk+VhpZCVtqxGKPJ3Lz45J

  Score

  10^/10

  discoveryredline5195552529infostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2