Extracted

• • Target
    file.exe
  • Size 759KB
  • SHA256 bdc0570be9dff25c0ba52ee4eb285a3ccfa5495bd8d8299fa214fb9a7a4ec918
  • MD5 846830c015aa2c138401aaff6f1d0531
  • SHA1 5863821f943b97d5a12429578c9eaa164e0e802c
  • SHA512 ac2d4292f8505ea5139f99e1f8a10d54cc0548ea61690ad4a54b48c901be4bc29255788dec03ee727fbcad9d104eccd72d8df7a7f5024280f6dd5efbf96e60da
  • SSDEEP 12288:aO15R1EK4I4qt7LdktyXTEk7/QfbV9g82Aa7/QfbV9g3KEiFA:XH14Ct7B8yXY48PF43Bf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline50kdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2