Extracted

• • Target

    50c33eaa07d5b99a35a9860123e2fd84551a0907170a199ead8f5e1e2b0097c6

  • Size

    314KB

  • MD5

    8240da70945e9b8a7844f1f4e2f1c770

  • SHA1

    37c0f67a71107a5821e1e3f98563e8c331f3618d

  • SHA256

    50c33eaa07d5b99a35a9860123e2fd84551a0907170a199ead8f5e1e2b0097c6

  • SHA512

    e8b6f7baa8ce2d0d2cd18ab59f15be033d8785a5b9c89e9b2cbd6abdfd169856ca11860e2f9cdf8c910f332aa26f39c8b093a0c67671fc05016ae3eb56f5c039

  • SSDEEP

    6144:JHAACjT1WsFpbp55axXma+dYLBbHjQYe7Ub7q+ODITYf2zi7moWRuRce:in1rSXOYLl8Ye7Q7nOsTY/5WAc

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)credential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2