Extracted

• • Target

    799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb.exe

  • Size

    1006KB

  • MD5

    c005d4ffa3e28c22b41a9d222598260a

  • SHA1

    57cc3a6540bc38c649ddfdd54fa4f3c8a2423677

  • SHA256

    799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb

  • SHA512

    ce39903c46160deeee1c7b362000361a3f5a9243b2e180bbaafa5b8ab09cc09ca413ce32f4deb2074fa928110d25b3dae7465c849fc388a58ddf649a9caa3a68

  • SSDEEP

    24576:WdZE+NmjQ5WymWeoSAj6YztpJF+6Xkb1rlNF:YZbAjQ5WZW2KNFNXmF

  Score

  10^/10

  redline@oleh_pspdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2