Extracted

• • Target
    SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439
  • Size 997KB
  • SHA256 daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7
  • MD5 5d189e938902eaae6f0f249af89acaa0
  • SHA1 b8f481af1a86b28c904df2cf56ca54f92da8112b
  • SHA512 0ad956c1ca67d942f8a46607b2bdd6047567decf4818350567baaacb7ca5dff051ad2810c7a2e2bda7630baede4fc3c91aa316b04584142fedcb4d757fc87cee
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline12345discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2