Extracted

• • Target

    27ba4999fcfef817e77c5a6ce9a47ad6215b4354fd9dab300ba841d74b294bc9.exe

  • Size

    904KB

  • MD5

    ae61cbcb19ba6f4ad388489eedb6228e

  • SHA1

    ee3a8e3816834d1f802520ae9864316582547e35

  • SHA256

    27ba4999fcfef817e77c5a6ce9a47ad6215b4354fd9dab300ba841d74b294bc9

  • SHA512

    1565d34c1286d822a2f105b15c8f2480a4d479c715f5ea37c46afae7c739a7fecf7a555fcf8193f6575885d20550d343698525565da59ac8d70808d75c7292a3

  • SSDEEP

    12288:B2EV1KWYMV+I4MVKWcR3It7UXuh+s9nb0+g+loFGtIZ7ppvuQrewRJDVJvsG:B1VMGRgLmIi+sdoPfGAd7reQBk

  Score

  10^/10

  redlinebotdiscoveryexecutioninfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2