Extracted

Extracted

• • Target

    0b47b14e356616bf30f9e0f7205f98fa1a8b5a115c9fcc1d968b4b86e0b08dd1

  • Size

    1.5MB

  • MD5

    9b776b053559abac6e55df060e72d8fc

  • SHA1

    8672d2d8b754e2fdfa11094864c09bdec59538a1

  • SHA256

    0b47b14e356616bf30f9e0f7205f98fa1a8b5a115c9fcc1d968b4b86e0b08dd1

  • SHA512

    e7555716429524573b15a6e8aa322da6c84e08b912f9674b7197bca271d6a09b706d5e96a8fa1ea1025d71010ec0d79c40e4950cb82ea491713415178e45b1f0

  • SSDEEP

    24576:my/zgTVa/Is053sXwGrky/gPmORIpxl5ymjd7voB8GF+k1LdriVdQzzbaHjB0:1/zg0/I1j07KmORIvl5yk9voBJF+khB+

  Score

  10^/10

  redlineboommaskdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1