Extracted

• • Target
    252a6a233d0be08e382758c0049fab4566e45630adeb41d4890be33f615bd2a9.exe
  • Size 12.2MB
  • SHA256 252a6a233d0be08e382758c0049fab4566e45630adeb41d4890be33f615bd2a9
  • MD5 e9db8909f3cbe77bbfd74f0f691800e6
  • SHA1 735e1fccc94c6ad5a853d90ab8d0f8ba7bf05693
  • SHA512 29bd58f9106934cf0accd4ff169d18a7de3d30b97f729dff212e98a48e983155607d7fdfb04f6f819e4499c38542bbed4921651d2920b15ec3b93b92a3f1a856
  • SSDEEP 393216:7Q3KEN+/9c5hlEK/PNMtN3ZW43X2qTzT:71q+lEhxtMtN3r3GQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinejajajadiscoveryexecutioninfostealerpersistencepyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2