Extracted

• • Target

    7f48f5eb6fe14caea09b99b3c1c08dbc6f389368a119388bd975d9197e4a7579

  • Size

    480KB

  • MD5

    8e0efc7565f594f64b9969f7eb14d0cd

  • SHA1

    ecfe04c5c1e802560a7e9495de432c1d64c10cf2

  • SHA256

    7f48f5eb6fe14caea09b99b3c1c08dbc6f389368a119388bd975d9197e4a7579

  • SHA512

    7cd5babda1d164d6c156fb392528cebcf684fa205ed8677f1b0bad90bfa4a90b8b1d11d6c34420b77532bc99776cb46eb02fc2253513795c971f1518b4d8313d

  • SSDEEP

    12288:jMrPy90YSUoed1ST9f3FB+vnRpPuHeKiaraCYv:Ey37pSZtgvPuBiEJm

  Score

  10^/10

  redlinemisfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1