Extracted

• • Target

    NеwInstً.exe

  • Size

    554KB

  • MD5

    65436a992b79948f161e0baab0cdaab3

  • SHA1

    7641c07f76daf85099c514e886163d50f3a90aa1

  • SHA256

    df9db7dad9455a98a10a485df8f7aee20286ce409784403b0b04f84930b77833

  • SHA512

    d8fde790422919547059915432623187369623ea326373cf55c0dead588a416085ca36ee310cb56012147f23367197921d873a037035d0a027a2005efe570837

  • SSDEEP

    12288:QbNufVPtxDKN/vFSXdemf6jo+o+UD5jcUWvprzuzCmHbL8SJTf4bYGgzaso6q8hP:QbNqJDKhFme+GXo+Ut8

  Score

  10^/10

  discoveryredlinecredential_accessinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2