Extracted

• • Target
    ff7a337d019cbe7812d281e8af9856aa764ff8d4321bb05d162954d1581e512a.bin
  • Size 91KB
  • SHA256 ff7a337d019cbe7812d281e8af9856aa764ff8d4321bb05d162954d1581e512a
  • MD5 ca9fe6e7dcc98c0a0a4c98564037dcaf
  • SHA1 716d103addea74d8492e269a372759df216df7b9
  • SHA512 29c29c4f32c062c9c0d2c7f69e56b2dc058a19b22e10e7db609c0f038db3970589cd0db8f82e1ade07da7e2e2113ec269a8d5af1327c32dd0059a24f2f4f773c
  • SSDEEP 1536:Cqs+nq3zWB16G6jejoigIExoNv+Hf6gi5eubf4kLdRxy7dPf3tmulgS6pR:goIzW+YEkv+7eBLd/y7dAR
  • TLSH
    T1DD934D7467DCEF08E6FE16B4A8B2131403F0E4869193FB5E0DC090E91EA7B5299179F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryredlineinfostealerspywarestealer

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2