Extracted

• • Target

    4697e774285a7b1624b2240cff212aa16a59a91bc1d397e55b5e4b1f1d54e95f.exe

  • Size

    897KB

  • MD5

    ea5544ac85f018a31087e04f1ab50718

  • SHA1

    f42105d23c169e4e0078166ef337e1bc5113ada2

  • SHA256

    4697e774285a7b1624b2240cff212aa16a59a91bc1d397e55b5e4b1f1d54e95f

  • SHA512

    3996ca3045ab923a20b4df9f02bb5d80edb5a9f8093092acde28cbd0944d92c53f6f3f60d46d7465a5962121e4689ce47f8cabd0afbb9eefd69ea81aa244cbad

  • SSDEEP

    12288:t1q4E6mfJiLl9LWcbQkpClSCFCGCxj1opLtc0+jcnloECEvR58JEAeJOj2WB6:hEkD5pClDFAjOL207nPt7dDwqWB

  Score

  10^/10

  redlinebotdiscoveryexecutioninfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2