Extracted

Extracted

• • Target

    e4337408876a523bb8afa0184f099bf2036d367abd20134a8f56dfd8aecb37fb

  • Size

    1.5MB

  • MD5

    adc322700285a7b56cd4c282098b995a

  • SHA1

    725e81d71f23b283bfd1063291419021a504fe63

  • SHA256

    e4337408876a523bb8afa0184f099bf2036d367abd20134a8f56dfd8aecb37fb

  • SHA512

    8c3a1df47d25d9643599ea5546e94b5ef5d304d49fa47f36009cb57d60b83a336cad26badb09d5a6661f8411f3b84d2a2b24ef3e1af649fb0d35469571965ffd

  • SSDEEP

    24576:gyZG7LiDjd64FFiWiF9zo2ECijsix7hlGmMpPmuapqNnmMlJ71Qrmh:nAfiDjd6SACxCirhlRoapqNmMT7

  Score

  10^/10

  redlineboommaskdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1