Extracted

• • Target

    b651797aedfe83bc134194e3ccd087d1f03b37bb6a959578b6f58f8888dde301

  • Size

    557KB

  • MD5

    5e0fb2470ae067c890f136f4f07f9a6e

  • SHA1

    9a6e0f75281e9224bc14f5bd30705239975011d1

  • SHA256

    b651797aedfe83bc134194e3ccd087d1f03b37bb6a959578b6f58f8888dde301

  • SHA512

    3c096325ad5ec5af4d4f4dd0d1d7f27e7bab254344016617884368dc8bd022fa71466b09a3774d792769e74437e026ec6380ea93081c1ab30340cdd0f3ade6b1

  • SSDEEP

    12288:DJ2y7DUJlR5rWiKTH72nAGtdRVPWP/5jTRiXU/5/Xv8kf0YQYrXDxwtqaAwcOpH:t2UDAlnaiKTSnlHWP/5jNXX

  Score

  10^/10

  discoveryredlinecredential_accessinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2