Extracted

• • Target

    e9556a821b82a81e1f915ee1427d3720ab109e07a1e072602e497a770e5ccc12

  • Size

    479KB

  • MD5

    db442cbb8f7c2fb1669067bb9dbf6046

  • SHA1

    cbb1af3b24ba582e7ecc1833e50a58a61a3ad1c6

  • SHA256

    e9556a821b82a81e1f915ee1427d3720ab109e07a1e072602e497a770e5ccc12

  • SHA512

    f6583f141a8606f969b47d29007a055d1f907d4e131f4e183fd741214d0792faf129eab0690137cb1d63082fec25b464358653cdf810077079f6a7ce3bd94c26

  • SSDEEP

    12288:ZMrEy90GT+MF2SA+/6MgwjY1T2Z/0lCnD:xy9T/2SR/6MgwjTZvnD

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1