Extracted

• • Target

    6d17c9629d39d317e000a48b9d9fb59ec31e3bc97b84b114170d6b62c3ba1cfc.exe

  • Size

    2.2MB

  • MD5

    cc3b838c63e0b872e8d82e907e327870

  • SHA1

    329cd955e1d242cefbf122e3c68c3b35fb74d96f

  • SHA256

    6d17c9629d39d317e000a48b9d9fb59ec31e3bc97b84b114170d6b62c3ba1cfc

  • SHA512

    e27785e788de4d44ca1717e2ace0a61d0e3c66da3ffac657885e4a85e4354697f6d9ed51ac1a7bf4f10482c6b7a1ffe5f5a6f434d065686b9c275e8c6eacc9fd

  • SSDEEP

    49152:V5O4DcuKF5i8avmG9OAhZVyMIdLTPf4Ut3qUqO6m:V5NRyG95ZgRdLTPf43rq

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2