Apps-anywhere-setup-6965a25eb9-1.6.0.exe Stealer Redline Analysis

Updated 2 years ago

Checked by Malware Check

apps-anywhere-setup-6965a25eb9-1.6.0.exe

Technical Analysis

File Name	apps-anywhere-setup-6965a25eb9-1.6.0.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.147.174
Database Version	2023-11-21 01:02:44 UTC

⚠

Spy.Win32.Redline.lu!heur

Malware family: Redline

RedLine Stealer is a data exfiltration tool that targets browser data, system information, and installed software credentials. It spreads through email attachments and compromised websites. Beyond data theft, it serves as a delivery mechanism for additional malware payloads, creating multiple attack vectors on infected systems.

N/A

Detection Rate

13,460,064

File Size (bytes)

2023-11-21

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	e886e15265a2bbf958909f1ce0db490e
SHA1	a5554a2c14d7903413ad201a0e324bda5d692ffc
SHA256	bdf569d1969aefb77ffb635e5ec28b338fb70d13c2851993c126b31437ab0273
SHA512	f36c67d801a6445a89b4ba00fcbbf03722196c2ee2bce53f147e06e51fc487e0d4883068353bfe4cbbe7a4321aa536e5d076a63b473857c2532b02a6a43fa780
ImpHash	646167cce332c1c252cdcb1839e0cf48

PE Analysis

Basic Information

▼

Icon	Hash: 3e91cc67e146308239c15a39134ff14e Fuzzy: 2e2cf0d16805fb9dfdfc9b2658485b99 dHash: f0f0f4d8c8c8d8f0
Image Base	`0x00400000`
Entry Point	`0x00406a00`
Compilation Time	2068-06-21 06:07:02
Checksum	0x00cd7e92 (Actual: 0x00cd7e92)
OS Version	10.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`wextract.pdb`
Digital Signature	OK
Imports	8 libraries ADVAPI32, KERNEL32, GDI32, USER32, msvcrt, COMCTL32, Cabinet, VERSION
Exports	0 functions
Resources	56 Resources
Sections	5 Sections

Digital Signatures

▼

DigiCert SHA2 Assured ID Timestamping CA	DigiCert, Inc. (US)
DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1	Software2 Ltd (GB)

Version Information

▼

CompanyName	Microsoft Corporation
FileDescription	Win32 Cabinet Self-Extractor
FileVersion	11.00.18362.1 (WinBuild.160101.0800)
InternalName	Wextract
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	WEXTRACT.EXE .MUI
ProductName	Internet Explorer
ProductVersion	11.00.18362.1
Translation	0x0409 0x04b0
CompanyName	Microsoft Corporation
FileDescription	Win32 Kabinettutpakking
FileVersion	11.00.18362.1430 (WinBuild.160101.0800)
InternalName	Wextract
LegalCopyright	© Microsoft Corporation. Med enerett.
OriginalFilename	WEXTRACT.EXE .MUI
ProductName	Internet Explorer
ProductVersion	11.00.18362.1430
Translation	0x0414 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	25,284 bytes	25,600 bytes	6.30 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AF345FF4844CAF4B46F0D1DE66BA215C`
`.data`	`0x00008000`	6,728 bytes	512 bytes	4.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7B9890A93C0516BB070E1170CFDE54D5`
`.idata`	`0x0000a000`	4,178 bytes	4,608 bytes	5.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6DD96376163996642EA3177EB8F57CE1`
`.rsrc`	`0x0000c000`	13,410,304 bytes	13,409,792 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`243391EF0E3EEF11BA4C310CE1304AD0`
`.reloc`	`0x00cd6000`	2,184 bytes	2,560 bytes	6.27 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`DDBA0788E55665F614E9118142A37359`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 56 (13,406,424 bytes)

Resource Type	Count	Total Size	Percentage
AVI	1	11,802 bytes	0.1%
RT_ICON	13	85,490 bytes	0.6%
RT_DIALOG	12	4,976 bytes	0%
RT_STRING	12	12,440 bytes	0.1%
RT_RCDATA	14	13,287,458 bytes	99.1%
RT_GROUP_ICON	1	188 bytes	0%
RT_VERSION	2	2,052 bytes	0%
RT_MANIFEST	1	2,018 bytes	0%

Certificate Chain Analysis

▼

Certificate #1

Subject	DigiCert Timestamp 2021 DigiCert, Inc. US
Issuer	DigiCert SHA2 Assured ID Timestamping CA
Serial Number	`17624174242159194906345698804472279261`

Certificate #2

Subject	DigiCert SHA2 Assured ID Timestamping CA DigiCert Inc US
Issuer	DigiCert Assured ID Root CA
Serial Number	`14129007222345747367286704854105834005`

Certificate #3

Subject	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US
Issuer	DigiCert Trusted Root G4
Serial Number	`11533403529598586876501374841704918745`

Certificate #4

Subject	Software2 Ltd Software2 Ltd GB
Issuer	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Serial Number	`3857630229308256319361480615603917685`

Certificate Verification Status

Spy.Win32.Redline.lu!heur Removal

Gridinsoft has the capability to identify and eliminate Spy.Win32.Redline.lu!heur without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

1
Get Gridinsoft Anti-Malware — it's a quick 2 MB download that won't slow down your PC.
2
Run the installer gsam-en-install.exe. The setup takes about 2 minutes and doesn't require a restart.
3
The app launches right after installation. You'll see the main dashboard with the scan button front and center.
4
Hit "Standard Scan" — this checks all the spots where malware typically hides: temp folders, browser data, startup programs, and system directories.
5
Once the scan finds this threat, click "Clean Now". The removal usually happens instantly, though some stubborn infections may need a reboot.
6
If you see a restart prompt, go ahead and reboot. This clears any malware that was running in memory and ensures your system starts fresh.

Important: Before You Start

Quick tip: unplug from the internet before scanning. Some malware phones home for instructions or downloads extra payloads when it senses trouble. If the infection is severe, boot into Safe Mode first — it limits what can run and makes cleanup easier.

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Signed in via Gridinsoft Portal · View profile

Your Score for

5 4 3 2 1

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now