Extracted

• • Target
    file.exe
  • Size 696KB
  • SHA256 1ce2a17f4a476674dbf6cf4e15c6d3ae424eee86f484edc38c9e6fdf97805bc8
  • MD5 9cca21b33d1141cf733bef2c6eb2c387
  • SHA1 40c22c19a756a64646eaf3ca5ecbdabc49da3bea
  • SHA512 c2e4b4b8dae453f3551035f85d3f49e688e96e3d3051daa10e2dc473a2bb4c4b8658971f19903ba39058b94abe8f37e9d37bb74dfaecd6721e75b738acb1727c
  • SSDEEP 12288:lEfScoAK5cwYqmmdpkbAStnkeemEiXJjHQKRaXQ/MRZuXXqzgZu4PeliNH+fLg:lEfSclK5cwYqmucEiXpHQKRhU+pPrNp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelogsdiller cloud (tg: @logsdillabot)infostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2