Extracted

• • Target

    c7ade082b83ae5e5c1eecab6ab89076f23aa36f3ba9e63a15a49e938bb2ebfb4

  • Size

    480KB

  • MD5

    b0c5ed8934ba9ce18453499884949ea1

  • SHA1

    857abc77ce81f637cbb599bb9dde1d621fb5d518

  • SHA256

    c7ade082b83ae5e5c1eecab6ab89076f23aa36f3ba9e63a15a49e938bb2ebfb4

  • SHA512

    611f2e5e1d5a51d51cc022e6597d84869184257f7a571e63a2cc8107f16e0e1babbe089e0b59b443e07406beeca2c925c9d3b25246389a8eef961de4be2dce98

  • SSDEEP

    6144:KLy+bnr+9p0yN90QESXDFzS7nepEihFZyUFYLJm8aZElenoMw9A+/OXQhf3jxFWk:NMr5y90qFzS7Wym8hYoIGPjxMbC64

  Score

  10^/10

  redlinemofundiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1