Extracted

• • Target

    14c18e17b9b31d78d90218ffdb2bc548be375da26fb86c6b88e2939516799a0e

  • Size

    479KB

  • MD5

    cb323ce39deabd1678d7eca62ca8efe2

  • SHA1

    e888da648427830a30b03e350c6ee9e4821a8a13

  • SHA256

    14c18e17b9b31d78d90218ffdb2bc548be375da26fb86c6b88e2939516799a0e

  • SHA512

    d5b83b6a9dec4b7b51ad33f8186e808052dea9ba4ed233fd2535868a3c2f0f32a8c85b6831241ed41cc0c2e148da22c4be918fe0c46d874fb3185c1907aef902

  • SSDEEP

    6144:KSy+bnr+Sp0yN90QENu8mnn9QJgv+eZnJc0sUC/JIHF6sE+/zmRKfs9mgo/ezAS3:aMrCy90Xm96gmeZnJO6HF68/iRI/TS3

  Score

  10^/10

  redlinedonadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1