Extracted

Extracted

• • Target

    01f7af27c5b42b0b49bc344e2906ae6c429378b4dfbcc71e46b4de5e7433c227

  • Size

    1.4MB

  • MD5

    6291aed729265aaea32a9f263fde0896

  • SHA1

    6daed072cece38a5381bffcf34b3298f7afc48f3

  • SHA256

    01f7af27c5b42b0b49bc344e2906ae6c429378b4dfbcc71e46b4de5e7433c227

  • SHA512

    bf77a223810337b24f23b945f2e2a4636264160d3acdff0bdedb70c4c2c36184c069d6002bd553d92cdc689c74de9c12e55cad248e8685d56924058b3d451e44

  • SSDEEP

    24576:yyf91UiusZIle6RaIxEyyPkYIPclVQc3t+LXvorodzpuZclHiOWWBRqben1Tq/JU:ZV1rwIIx1yMYIPclVB3mmXLQRqbgRq/

  Score

  10^/10

  redlinegenamaxbidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1