Extracted

• • Target

    fccb7dcda96e7447af735df9dabc38597df936d567d829b739193042dcb6a441

  • Size

    587KB

  • MD5

    99f635673858012bf0664c2872b93b26

  • SHA1

    e1710d794d9a84516d4b1f5dd3a5ffc11a484275

  • SHA256

    fccb7dcda96e7447af735df9dabc38597df936d567d829b739193042dcb6a441

  • SHA512

    ce2f34fd0f933da532435744be7ce5bd3a88ec1528da240f338ea0aedbe55378fc0985079694350df53f6ed39e1f51a3422104b1a0d5dde9afb58a710e351d33

  • SSDEEP

    12288:rMrny90/9Bu7bAdKESsd1v1ouUcrnW6Z3OzvYo6vx:Ay+SbAJ9jownToW

  Score

  10^/10

  redlinedarisdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1