Extracted

• • Target

    1cc0172b43eee128b12fdb7a06241ba64fb75dd2cb68eaa6227a0b25319e0dcb

  • Size

    556KB

  • MD5

    1be32b7d8ed4ccec465e583abd24bb1c

  • SHA1

    078ba1a06eacef5e2dcdf387984d59de53788eb4

  • SHA256

    1cc0172b43eee128b12fdb7a06241ba64fb75dd2cb68eaa6227a0b25319e0dcb

  • SHA512

    f2a32d994badaaec12c61b81d15157b28a7f4d267bd9c6fb06e8b106876a5894906544bf94d254e1813787c78fd43581e987008266fbf472135c3004f4886e6b

  • SSDEEP

    12288:yMrKy90JrCdIu63oy3xHeca5rLQcRk775:UyZYoy3ha5LZu7N

  Score

  10^/10

  redlinedarmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1