Extracted

• • Target
    585368207fab5116640f854d6e6f742a
  • Size 162KB
  • SHA256 2beba1a84ca6a357ff2e8fb49b014523c855b73195e04829db7ee94afe87ecd8
  • MD5 585368207fab5116640f854d6e6f742a
  • SHA1 b1e7b1a232e971c70a168c918cf6fe506663f707
  • SHA512 ea006d6f4132ca1ac3a5dd007fc7935db239092b3803707b7753f71bd743e55e084a4b87d9d897a789b6359f9311630dddaceef39af94e5d2ba43bfa0d267c69
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline18_6_bl_84s7discoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2