Score: | 72 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
RedLine Stealer | RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. | No Attribution |
|
AV Detection |
---|
Source: |
Integrated Neural Analysis Model: |
Source: |
Joe Sandbox ML: |
Source: |
Static PE information: |
Source: |
Binary string: |
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
Source: |
Binary or memory string: |
memstr_f261fa75-7 |
System Summary |
---|
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
Source: |
Large array initialization: |
||
Source: |
Large array initialization: |
||
Source: |
Large array initialization: |
||
Source: |
Large array initialization: |
||
Source: |
Large array initialization: |
Source: |
Code function: |
0_2_00408C60 | |
Source: |
Code function: |
0_2_0040DC11 | |
Source: |
Code function: |
0_2_00407C3F | |
Source: |
Code function: |
0_2_00418CCC | |
Source: |
Code function: |
0_2_00406CA0 | |
Source: |
Code function: |
0_2_004028B0 | |
Source: |
Code function: |
0_2_0041A4BE | |
Source: |
Code function: |
0_2_00418244 | |
Source: |
Code function: |
0_2_00401650 | |
Source: |
Code function: |
0_2_00402F20 | |
Source: |
Code function: |
0_2_004193C4 | |
Source: |
Code function: |
0_2_00418788 | |
Source: |
Code function: |
0_2_00402F89 | |
Source: |
Code function: |
0_2_00402B90 | |
Source: |
Code function: |
0_2_004073A0 | |
Source: |
Code function: |
0_2_0215E17C | |
Source: |
Code function: |
0_2_02152ECC | |
Source: |
Code function: |
0_2_053A1638 | |
Source: |
Code function: |
0_2_053A01D8 | |
Source: |
Code function: |
0_2_053A01C8 | |
Source: |
Code function: |
0_2_054ED3B0 | |
Source: |
Code function: |
0_2_054ECE88 | |
Source: |
Code function: |
0_2_056B04D0 | |
Source: |
Code function: |
0_2_056B6C18 |
Source: |
Process token adjusted: |
Jump to behavior |
Source: |
Code function: |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Static PE information: |
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
Source: |
Classification label: |
Source: |
Code function: |
0_2_004019F0 |
Source: |
Code function: |
0_2_004019F0 |
Source: |
File created: |
Jump to behavior |
Source: |
Mutant created: |
||
Source: |
Mutant created: |
Source: |
Command line argument: |
0_2_00413780 |
Source: |
Static PE information: |
Source: |
Key opened: |
Jump to behavior |
Source: |
Process created: |
||
Source: |
Process created: |
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior |
Source: |
Key value queried: |
Jump to behavior |
Source: |
Window detected: |
Source: |
Static PE information: |
Source: |
Binary string: |
Source: |
Code function: |
0_2_004019F0 |
Source: |
Static PE information: |
Source: |
Code function: |
0_2_0040E230 | |
Source: |
Code function: |
0_2_053A8481 | |
Source: |
Code function: |
0_2_053A9A61 | |
Source: |
Code function: |
0_2_056B900F |
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
||
Source: |
High entropy of concatenated method names: |
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior |
Malware Analysis System Evasion |
---|
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Memory allocated: |
Jump to behavior | ||
Source: |
Memory allocated: |
Jump to behavior | ||
Source: |
Memory allocated: |
Jump to behavior |
Source: |
Code function: |
0_2_004019F0 |
Source: |
Thread delayed: |
Jump to behavior |
Source: |
Evasive API call chain: |
Source: |
Thread sleep time: |
Jump to behavior |
Source: |
Thread delayed: |
Jump to behavior |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
API call chain: |
Source: |
Code function: |
0_2_0040CE09 |
Source: |
Code function: |
0_2_004019F0 |
Source: |
Code function: |
0_2_004019F0 |
Source: |
Code function: |
0_2_0040ADB0 |
Source: |
Process token adjusted: |
Jump to behavior |
Source: |
Code function: |
0_2_0040CE09 | |
Source: |
Code function: |
0_2_0040E61C | |
Source: |
Code function: |
0_2_00416F6A | |
Source: |
Code function: |
0_2_004123F1 |
Source: |
Memory allocated: |
Jump to behavior |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Code function: |
0_2_00417A20 |
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior |
Source: |
Code function: |
0_2_00412A15 |
Source: |
Key value queried: |
Jump to behavior |
Stealing of Sensitive Information |
---|
Source: |
File source: |
Remote Access Functionality |
---|
Source: |
File source: |