Extracted

• • Target

    ca91eb974b54f845fefe42e0142a7420c2b81d913e75d2ad9c2880d1141089b7

  • Size

    588KB

  • MD5

    4d22caac51a77ad8c6d22dec3c084236

  • SHA1

    477afa1a9f78d7d5a66b93c0d6bd8aebac271a4c

  • SHA256

    ca91eb974b54f845fefe42e0142a7420c2b81d913e75d2ad9c2880d1141089b7

  • SHA512

    014974ff7f456394e7d4739356e01a2597299bf61dfb4c09f9f6dadd12f065a2e712a978efa0c8ca4f8ad34ef7df99598cdd2ec8a505bf7d7a3198b3a869ab2d

  • SSDEEP

    12288:zMr9y90oisIRHBOD8WmWlaMo+m9XVIzKbC5eE63uAWV2Y:OyMsIRHBOD8QaMorVIWGpAWVL

  Score

  10^/10

  redlinedarisdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1