Extracted

• • Target

    dcf16f98c93ba7155037cc07d0f280ff65ca1ea103d142d948da70451c2c3ca9

  • Size

    479KB

  • MD5

    6b897c6e643053b711315b03379363a0

  • SHA1

    4d10f703bd059229587ca6623967065dfeba6b2b

  • SHA256

    dcf16f98c93ba7155037cc07d0f280ff65ca1ea103d142d948da70451c2c3ca9

  • SHA512

    f239acb40bf05e5caaa9b08f46f9074bca8a9f50e8fba90892e0c32d15db19c6c6543c6a1a9f63d66fa1250330ec5dc0b3c8066551519dd5e275b4965b0d7557

  • SSDEEP

    12288:vMrOy908alJlkNBB6Oe2NBwpnM05lMp5:NyyABSeWpnM05lMp5

  Score

  10^/10

  redlinedoumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1