Extracted

• • Target

    5299590e69d031fa7b4118551f59a41091fe97aa3513494c910f9a6011a6e6fe.exe

  • Size

    2.8MB

  • MD5

    8f86128dfea02b5f1b28221aa0fbb391

  • SHA1

    ac249d130db76607902fe00c467db5683ef531fd

  • SHA256

    5299590e69d031fa7b4118551f59a41091fe97aa3513494c910f9a6011a6e6fe

  • SHA512

    21162185db4bf61c0cf4d8a70cd302b4234cf91c57e113fead69264d30bbd61eb7382d4b9e6b5fa274de6e81beefa062792018700326b87c751597a453fa326d

  • SSDEEP

    49152:wbkzSYl+aFUUhf3LIc3VEarMlonlT3ZGfdPjTV2sJ7CQUmhS:eoLX3VEarXs67

  Score

  10^/10

  redlinexxdiscoveryinfostealerpersistencespyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2