Extracted

• • Target

    19e574c5eac68099d6445f2cb24048edba394fe568a3061e7d6f986c42ae2228

  • Size

    479KB

  • MD5

    fbeeba4e544e8e175fd4245e7c10b1e4

  • SHA1

    54bf482079184e79f645a03bef12f974037dbd61

  • SHA256

    19e574c5eac68099d6445f2cb24048edba394fe568a3061e7d6f986c42ae2228

  • SHA512

    6e08a18ee0c29ee247c3f28d3522cc9ebc42dec3c9ab97e4f95452a99beaf09d51f1575f4a278ddfe2d084119f643fa0e7559fdea0e321ad0b9fa501afe13438

  • SSDEEP

    12288:7MrKy90boiyuSni4jxM5c1u317Tix/eOEiPRtu2G:9yyyFzjmXVT+GOEARkz

  Score

  10^/10

  redlinedonadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1