Extracted

• • Target

    39382629.exe

  • Size

    1.0MB

  • MD5

    e8baebcd4279a203d5d3b6b21f753e5b

  • SHA1

    60382eed3e26e8b20830749b0c1a872057fd362e

  • SHA256

    cb4a22756f39ea5c69e24772b8eb6d004962196c683cc2d7742eb89e65836890

  • SHA512

    2624efc40e014e44f5cb9e3628d1d9c01d3424a9e48c2cc13d6d67de891d913dd055f1c615c6827d83e20807b12ddb722166c5c7ec7cd2c262f51e8c058c822d

  • SSDEEP

    24576:Wj30ivvE/4NzF4xuY9lOJ9IQ32vfeSKzk0Oq3Gf:Wjki3E/44x3bOp2fqxOO

  Score

  10^/10

  redlinebotdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2