Extracted

• • Target
    3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe
  • Size 3.4MB
  • SHA256 3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b
  • MD5 8c3ceea3b691db5fb95a2eafb8d4d6ab
  • SHA1 23f41aee89765df74985c6cf1c1ca6e9ed24e4be
  • SHA512 3b2bfb208630b6ee493edc6983e44c3b61ecd398cbe1d00131b7c8506021a507309b98817db970bba905963ff99462f73951a28f5ec0c05525ceda8599bd44ca
  • SSDEEP 49152:q9cmN7aydjQ0UxNJT3fscY52VlBJXYfwEXBTb2y2meFldedaHrE76n5P/Afl:6wUjQ0UVEbkrBJXkB3D29ptHg76n5y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionpersistenceredlinejajajainfostealerpyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2