Extracted

Extracted

• • Target

    2dec91c5da0b6c22385a236ed591c311364db0a35ee98806a5ba9193dcf1a8c4

  • Size

    1.5MB

  • MD5

    b77161e3ae84a9aef9f084ed5a915876

  • SHA1

    1277a6c9171088aa9a0b282c5391c0a24dbba957

  • SHA256

    2dec91c5da0b6c22385a236ed591c311364db0a35ee98806a5ba9193dcf1a8c4

  • SHA512

    9e6e078ae06530c62460fec4a58acca8d9a62e1f6d8213cd11e964ea7e122e6aba1f7bf25482e6229817d7aea3341ddf4a221fc1a8bd87faa30c4ecc0584a1a8

  • SSDEEP

    24576:Xyoo8HOVLptIvIVE6sBYMAkUkspx6z5kAuc3UZX+8IJFkuWlrirzwrjOd2U8:iob2LLLe6sBYr3ksv6z5kAuvZOJFkXZo

  Score

  10^/10

  redlineboommaskdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1