Extracted

• • Target

    f7a1329e5d2d787c17e5357dfe8242f14dc9e1faf5981a1a4d9d8d1d6511f9ff.exe

  • Size

    2.2MB

  • MD5

    a7fadc5ffccd272e1f3e5dc1717926de

  • SHA1

    d7ec968dbd537158f91b3493fd5f6657e7572836

  • SHA256

    f7a1329e5d2d787c17e5357dfe8242f14dc9e1faf5981a1a4d9d8d1d6511f9ff

  • SHA512

    a297600ba51c2ffa19ddcf0183a949393ea138240cb404ad38b4f90aaaf2dbec2cc8e4cc3f32678ae01e65653f18d91782fde4e3f54789c161986f2561d981d7

  • SSDEEP

    49152:V5OXoeI6Fye8Aivbktejn/dGiGf/vkADafh2KdOTD5Q1f:V5Youevbk2ngiwFafhLOT9Q1

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2