Extracted

• • Target

    b04e27d7e3b292b9fc2158c609ba05c0cf47fac3224451f7ea42d03941dbb438

  • Size

    480KB

  • MD5

    cb1c18213e0a955e99fe9807f18acc1e

  • SHA1

    97a9592b476524d97dd6ce7961c7aaf9aa3c1586

  • SHA256

    b04e27d7e3b292b9fc2158c609ba05c0cf47fac3224451f7ea42d03941dbb438

  • SHA512

    1357cacbffecef9768609b034e615ab3338b848b45d7c295b425fd21f42bdb9c07d19620d67377de1dec82908dde142049aee1fd59d3feefc6e4eba52ef4209b

  • SSDEEP

    12288:kMr4y90CzAtucUS4UNG8B6LUiO+6z50q8:EylAI8j9NBd0q8

  Score

  10^/10

  redlinedeasediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1