Extracted

• • Target

    PayPal_By_Funcom_8_1.exe

  • Size

    5.2MB

  • MD5

    11012cd20c49f35d5f2c9d13e88fafd9

  • SHA1

    25b3d46568d5e3979eab3c9c95d177a873694fc3

  • SHA256

    f950e369cc56f756cd32b34f5a76d3fc1fcb2f952c1e4b1543578d4b9e6f0f5a

  • SHA512

    f09de19214108f856c4d9823f7b9396e38682a273414ec0d171f285d770ac66124bbe31737a75931c96d12c47ea9215dc85782f22b27a5628dc6724fe4b53b06

  • SSDEEP

    98304:eOKodoqmGir38TrSleSgQiGO4jx4jROJhflp4jI4jk4j:e/Q7i2rSa2x2Atp2I2k2

  Score

  10^/10

  redlinediamotrixdiscoveryinfostealerpersistencepyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2