Extracted

• • Target

    file.exe

  • Size

    323KB

  • MD5

    e8e6cd9ec48fafccc174f7bf07d045e2

  • SHA1

    0dfccf235dc62d2592f5062a1b9691043c14cc9e

  • SHA256

    76b4e6a99335d5ffa35e15863b544bf2ec9ed76cc8320e1d3e2f521a27018d07

  • SHA512

    33e6c097784b29d3cba17b751b3e87ea9d583dbf19646897843471f96efd88e9b64d529a5f2c9fa13b9edad5d7ccf8d454e496fc63f1b288c44fd8509e8c1459

  • SSDEEP

    6144:abAWIT0bNaTfjfPsC/LEkuPlXVRKur64ZXzK7rrn31nvFRHW/SPxjM9jg3gfQ9:abA+bKTDjEkuPlFEurPm1nvvHW6Cjg3n

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)credential_accessdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2