Extracted

• • Target

    5920fe153d58684fbbba3e5f76a55b0ff44ab91751a7bb0281f62db97cb51d23

  • Size

    479KB

  • MD5

    1c24a456c1f9e126420443f56f9f7bef

  • SHA1

    3d63715a1a469dfbe5604d0c1152a0c3e07b374e

  • SHA256

    5920fe153d58684fbbba3e5f76a55b0ff44ab91751a7bb0281f62db97cb51d23

  • SHA512

    285f37230ec31a3d09470df5f07e14f6f4c3fd5a15da78d8850c146a74196e0badea95520dcb2a8fdfe2440cf6c18e885f4c62936dd56ac23aa5442c129f0174

  • SSDEEP

    12288:xMrWy904jhDFQUE9U2rN0Za+BAG5s/UTY:fybhhQUl2Wxs9

  Score

  10^/10

  redlinedeasediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1