Extracted

• • Target

    068b96ec2a520caf46a59385b9910b282cd240fd43840e20e3c367b7cd010cfe

  • Size

    305KB

  • MD5

    1b7df1a423ea6282063fd060266862c6

  • SHA1

    b78873befbfc35d28efbe685c6b6ab858ba66174

  • SHA256

    068b96ec2a520caf46a59385b9910b282cd240fd43840e20e3c367b7cd010cfe

  • SHA512

    7aafd159eb0d78d788d241a0635acee0f58e12f9be9faa8609bfee6f7f120f1a939604a41ce31558a0a978ce02545d929ae1b615b863ecb37d0cb5a89ed8d7a8

  • SSDEEP

    6144:jJHGyoPwcMZAwSYQ1rL4OgbDetAfhiRdsLvOJ0tYRVlOPAKeJNO4:RGyoPwcMZhnQ1rL4OKDeMhi3sLv7cY4

  Score

  10^/10

  persistenceredlineeewxdiscoveryinfostealerpyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2