Extracted

• • Target
    0e9be246e37eceffedcf036d5bce39e9.exe
  • Size 5.9MB
  • SHA256 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd
  • MD5 0e9be246e37eceffedcf036d5bce39e9
  • SHA1 f312a3ea84511be2512692384f7611f1c128ffe9
  • SHA512 531a08e4614a01a367c7ca6704f8589558157d6c615657e8a510dca09756ae5ff3a008a06f803d1cb00c3db6aecc6c2d0d840de244d50d1ef74ba9aa51c6332c
  • SSDEEP 49152:zYTbKuW0rl+W1iKKsmBwIFCqg4Xr3H6gWPKBnpuhpFqo3m1lnQwOXOZOJSmSMqWq:6+G7z5sqGMv79Ce6Q+K8g/rWlVkTh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinecheatdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2