Extracted

• • Target

    20c00490073d178d700ea9fc5c66962935f874c704833bd95bb0f20cbf0e81a7

  • Size

    313KB

  • MD5

    6327191c97297473cbd16fe27c5e23c9

  • SHA1

    43cb395c65b39956efcabe330b9eb5969939c77c

  • SHA256

    20c00490073d178d700ea9fc5c66962935f874c704833bd95bb0f20cbf0e81a7

  • SHA512

    d66ee18d30d13df99b07998ba51a8fee446a10795480bebe9f1091a590e93b895cff9f133a78a4e918c20e030f214b79c9fadfe5d6818be8c6486646099e4a78

  • SSDEEP

    6144:DtoxwySMnzhaYcBNKuJfXrabgjGtho1ruvVTjWRgdhgLYPgokEdoHyY3lnZO:Du/Fn8YcnKwf+EGw1ujWRMCUgokEaHyS

  Score

  10^/10

  redline@oleh_pspcredential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2