Extracted

• • Target

    e562350ac16b03fc5910687e05a919933cc2f8dfa9fe4567e6ed45581c7fdc12

  • Size

    587KB

  • MD5

    85c6c62c6b39d8c8188ecdee9dd78c74

  • SHA1

    e1dff04fa116d85a67a31693f63f942d7be68d53

  • SHA256

    e562350ac16b03fc5910687e05a919933cc2f8dfa9fe4567e6ed45581c7fdc12

  • SHA512

    03519152ee3dff5776573dc22384129839cc3e19a8af38f705c649f9a25183f657fd9120803fce92dc592fc1e177f9458fdcc4a2f0fe97881f6630bc9ab265db

  • SSDEEP

    12288:sMrcy90BxGgIl+8Kb6RtH3rRsuMxKc9bSkHt2Ox1x:oyE156vXrIsc9n2Ot

  Score

  10^/10

  redlinedarisdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1