Extracted

• • Target

    ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74

  • Size

    480KB

  • MD5

    00bc08db16053d06de3dde825bd163e2

  • SHA1

    38b0038120678226e437a0ee5e7517079a4dee0a

  • SHA256

    ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74

  • SHA512

    4d5cb9da4e0bb065ea2171aa1f33aa2638247ff48a07234880c341b0aa3488ae9fb8ed040b163ce6fd0527cbc81c8b799267adbffaacdef1e3f982821337b7c4

  • SSDEEP

    6144:Kgy+bnr+9p0yN90QEEaNE+p9YMLQ3TckMnpD2DPfwUI/AdP00NFB3wEQr2cDVAzH:AMrpy90zDDQ02DnrsQFBnQaKDPH+BMU

  Score

  10^/10

  redlinemisardiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1