Extracted

• • Target

    file.exe

  • Size

    312KB

  • MD5

    7f763112ff2d56b045084192e1ff9ff9

  • SHA1

    1037d19845aabd5fce1f98ae8fb7a89e2c0cdd0c

  • SHA256

    eb61898f47a0fc4109e1b5368162d6e64aec443193b40792a9d9e918f93d8b20

  • SHA512

    52c92cc942010c311a035cb23959fe27d9a065ec870c60989654a9e4c7e7b94c5cc45a96a4fa51a091c248d69afeb2f23b0f57c3af8362c799b8e6cfb7b88e71

  • SSDEEP

    6144:gpXRY2x3RG9r3cTVZgacvbAozLKIc5nxXNKbfuxUZKPGlVkFey1wNMbsrUeiorO:gpXRY2xComAAqnSud+lVkg14qr

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)credential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2