Extracted

• • Target
    a1898e4ebec6f43b6448701b7cd456c5
  • Size 682KB
  • SHA256 393aac4cba99e10526596a762318a76c8380e1283ccf01aad2b10f5e5b0cbb90
  • MD5 a1898e4ebec6f43b6448701b7cd456c5
  • SHA1 187645cff22119efe8f5e760fc6639bccf8c142a
  • SHA512 2bda4d90df9e47e8b0d8d7f25c4ebb9af2d8fa9d5cd571de2aa556aa48cfd535379408e445cc335e9a40984a0da5b53cc00f8ab67dccd279a250b31f21a2da10
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinehcwikyy0pfw4gqlldiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2