Extracted

• • Target

    82757f586d20ebc0bfa71231913bb9807250e9ee0013803229ce3b5aa8c1cc2a

  • Size

    479KB

  • MD5

    dbc76e1a5906f5c9e80479e4c4dce64c

  • SHA1

    e1f8373b30572a65e034ffc5dda8aad3559c961e

  • SHA256

    82757f586d20ebc0bfa71231913bb9807250e9ee0013803229ce3b5aa8c1cc2a

  • SHA512

    d27dc96eb7bb2dbb92eab252b4dbdfe8be5ec08264b2bae2beb2300120cf42c4330deb1059a7df24d5274ebe62d2857577b0c4cb959a8065868372fab27cb9d5

  • SSDEEP

    6144:K7y+bnr+op0yN90QEGy3fH1w2o0n0aOkEUQJjnwDTKu21JeshfO+Xa47+TcWGI28:NMr4y90sW1wb0004eTK9UYK++Td/D

  Score

  10^/10

  redlineditrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1