Extracted

• • Target

    Ехternаl 2.4.exe

  • Size

    313KB

  • MD5

    2225ba07e4bed2fdd12f2d29d1c1a72c

  • SHA1

    29c610f92adb7dbbb497a3fa48f4c887a3484372

  • SHA256

    182d7b64bd5299fa03ab74d4ed79c56c31fdc2f48d98b70f8efa438026d97710

  • SHA512

    ff2b05ed63b8456a68c269e51e7a605dd7c4b204b1417fbfc511aa10adc56d1b1b1234d71a87d7d753d41e1cd7312c0dc9cf3c3713aa21ff61e843c0e1559242

  • SSDEEP

    6144:hrH/AO8NeKh6P5H3spEWuXdfcSmH2X/55rADj79Pjg84dDpZ1nE:hrH/AOb/oEWuFBAPVjEDpDE

  Score

  10^/10

  redline@exelztcredential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2