Extracted

Extracted

• • Target
    160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
  • Size 173KB
  • SHA256 160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2
  • MD5 1e2802760f0b07c1290456694ebf5423
  • SHA1 9a3a72436ac7d49aeedad5b4eae74173cd8dcb41
  • SHA512 197882aa57c2dba7a827f3d0b04428c9d31c09a184b51a0f4dac9a6d47e6127a02fec195d2ac96d72bd8726917e360c985ea698c55e5b45b065f6b8dd0e19b0f
  • SSDEEP 3072:7TQnFeJSrE+G7HRT+rnnDdSzOXueSX5xU5vcOdJRY8pvNBGxEYTlzCS/u:75MrER4nnhyOXs5xETdJRY8ZNBGnXu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline@moriwwsdiscoveryinfostealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2