Extracted

• • Target

    cb040701aa1d6b4106efab4eec5f2355b18af9ebd6e70694931215e51ba430bb

  • Size

    479KB

  • MD5

    c3c9feb1bb13682f77b213720f366770

  • SHA1

    4954a562b71ee96db586df9f6d281f185506584b

  • SHA256

    cb040701aa1d6b4106efab4eec5f2355b18af9ebd6e70694931215e51ba430bb

  • SHA512

    a9822d082cd7b4f5d2a4942951a5db60257bcf6c8fb1f730e89eb22481e9341c4ff1c35ae25b6fb625982a4091d5ff4e5f516199dfd35d64fdbe355b73eebe13

  • SSDEEP

    12288:9Mrcy90psiQRjSSVCDVrXLozt1tWdSD32bA0:1yCsBj1VCetWdlbl

  Score

  10^/10

  redlinedumuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1