Extracted

• • Target

    2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc

  • Size

    479KB

  • MD5

    2e0f228d9138a50a7b093742ed1c9910

  • SHA1

    1cc6640bc85a779cc66bc53ec3c026b1f93fd7e4

  • SHA256

    2726a572396a9721640a622afbd1d67143934533dfcc48d761b6fc5c5bd20fdc

  • SHA512

    5f91f5ec51350830801b3a822c9a03ed2723232573ed48b43ef72417d35c6ccdc7de1e68c6e7fcf69af28995e0efa4ea6b6d56190e27151f72bf17911058738a

  • SSDEEP

    6144:KPy+bnr+Xp0yN90QEfLKPR7dx/o8N/ZNVeXDCY99Pxn51fKWgQfpLOe6MZbX:dMr7y906ASvsXP991dp6ebX

  Score

  10^/10

  redlinemufosdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1