Extracted

• • Target

    cec4373b95ed3fa5978d90a519858bbd6f55bcb2be5c0990a12a1a66c8b7c0a9.exe

  • Size

    709KB

  • MD5

    04733e68393c30867c3e6f9d9c75efbd

  • SHA1

    6a7ccf57685ad4a37c28799eb1a47182f3726adc

  • SHA256

    cec4373b95ed3fa5978d90a519858bbd6f55bcb2be5c0990a12a1a66c8b7c0a9

  • SHA512

    797f4ec4738831e07d4b3affc39cab165d1110fa470282d1e821c539e13baef8424721e5df8dcb493759b934bcaa408fff26f2d1be2ed22f3dec74821cc258f7

  • SSDEEP

    12288:cPGO3+TQNW1wTpHK2eF8kF4zv9b01yuiEtIlu1Y23b5XaU:SdNbBKDZ4truiEtT1Y239Z

  Score

  10^/10

  redlinelogsdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2