Extracted

• • Target

    ddf2e3e65930967f99b4d54904f373c6d915a8c4e7257b608b7a90d1438915b5

  • Size

    479KB

  • MD5

    90ea5cfdce184989963c96eda126b644

  • SHA1

    530e2260f2f8441175e9f7dc1810b3a75aa3f3c9

  • SHA256

    ddf2e3e65930967f99b4d54904f373c6d915a8c4e7257b608b7a90d1438915b5

  • SHA512

    0f1de74d31f6eca96c726fe683c35f1bf8b4bc5a94c660f2653e97785f0c0eb5fdad88f6948d51790c272840176ee397c311d66d24f9733a5c277eb362d25b9b

  • SSDEEP

    6144:KJy+bnr++p0yN90QERCFMyd0VMK8mhr2vXyGMw6zlScvtYn3LSUfcKmBp5L4:/Mriy90yFMLmm2yXSSGLYL4

  Score

  10^/10

  redlinedeasediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1