Extracted

• • Target

    e8d2ee7f148bbadc84151677c9820d8c77f5224afe5f3ee1f26738cbd8900489

  • Size

    479KB

  • MD5

    3e3220c75ba1cbaa6bb2f6c021f13e47

  • SHA1

    a13c957fa6e176b7bc46819d77e8a738e6dc024f

  • SHA256

    e8d2ee7f148bbadc84151677c9820d8c77f5224afe5f3ee1f26738cbd8900489

  • SHA512

    8ba1526c66e9b2bebf10d7233e642a4a24e51a92693bcfdcd79e145ce0bc9a0acf6847f9898db304e5ed1f6add517398de0952467f8c5203bb094d5173b8499a

  • SSDEEP

    12288:gMrYy90UmDnR/8re3UGnIvG0gOisk+wLMh7zfRt/ON:IyIDnR/8C6bisM4t/ON

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1