Extracted

• • Target

    b75d7255bdc0b9e43e7883f5da6436f7a77a0a4231cbe91c4b3129b466ed66bc

  • Size

    479KB

  • MD5

    d133d77feb34e46a44ddff82cd709c99

  • SHA1

    4eb2b537316c5c5813f38a8581e51ab6a5aa09c1

  • SHA256

    b75d7255bdc0b9e43e7883f5da6436f7a77a0a4231cbe91c4b3129b466ed66bc

  • SHA512

    787552837b91b90ec764608711d381a29657eb6c1878e825b42a40365efe920267158c1f1fcc872918f2d08581a8ea9c8aa90f7baaf557323d89621a9b426b97

  • SSDEEP

    12288:zMrpy90LAT8FJZpvoI74C2lRfIo34yh0z4X:my5yZFHlo347u

  Score

  10^/10

  redlinedoumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1