Extracted

• • Target

    065f3ff5b0c32d7b85cc6bb7c31da2c5768b4196a8d680eb5cb618ca63dc785bN.exe

  • Size

    23KB

  • MD5

    18de833f051305997aa4884c168db680

  • SHA1

    3a1c1f4bb77ba0e6d407369ec6ff240ec3560bd0

  • SHA256

    065f3ff5b0c32d7b85cc6bb7c31da2c5768b4196a8d680eb5cb618ca63dc785b

  • SHA512

    54c1dd816477e1dde84a085b516342f8729f447999d1d9eca9854a859d8d0e7dd8b403f03bb0a60f5ce3b4d6f2c0190641cd4ebc5aa2a192e8974071991dc7da

  • SSDEEP

    384:xNJxUsqwM3Eg8nC5mzn6NUeYCDSfxfPIrfZMEsPDhxWBtIBjMKPxiOW4EU:xNJxUs1oYCDONEIfDBu

  Score

  10^/10

  persistenceredlinediamotrixdiscoveryinfostealerpyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2