Extracted

Extracted

• • Target
    file.exe
  • Size 1.1MB
  • SHA256 88ab1357fe12b53be4b4f143d3b82d6b0f8a5fe08d23a0c53f2f588f7d181d41
  • MD5 6b8db6196f7b1653dc00a087316b6398
  • SHA1 b21731ec999df2ad455f7244581724899a8504df
  • SHA512 66a5086f0ac1a52af6eee20ec0374c527c8134af009752e3be97a892f230ad2434ecab1e6e97d91d2a07dfd14976d47f81b9d4807b7a58cd01ec5f2ad0765828
  • SSDEEP 24576:9mJZW2wSdIHuiCyhuGaD0y13DrmmfVpd+c2ZAa7ZRa8QDmAEzjBQ:9mJZW2FIOiCIuGaD0yh/zvd+c2ZAafaS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline1_17google ads 6.10discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2