Extracted

• • Target
    e0149b299e7295b128b1718310805095.exe
  • Size 662KB
  • SHA256 79fa3363eeb543f7b97729d016d926820156b2a549a78000899a2a3b44721c8e
  • MD5 e0149b299e7295b128b1718310805095
  • SHA1 ac23422e9538504f173a9e9fade0dcef6facd4a8
  • SHA512 88972a08cb09763c753b59c052eeeeb9bf7892e2314ef52425f853a3bde0e8ae561b01b36977cd81c32fa4931883ecadb5af1af46b1bc58c76b1e7c245050a6b
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix23.02discoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2