Extracted

• • Target

    a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

  • Size

    479KB

  • MD5

    a102e3deacf5f85a7a34a64ffe4f2932

  • SHA1

    c3de62f61ad2a94c6ae792cd6e19f23eaaeaac26

  • SHA256

    a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

  • SHA512

    291ded56a0769536fd9ac67fc45696f03dd2f5a7ce95b7af49ec08b7c10509a49d13b9b327499273d7ce7d60c9f2f6d63288bccb442516aad0db8d13198172fe

  • SSDEEP

    12288:lMrgy90wLrKFETn9l5IqIW9GolqLlbdXIHDDyNaAs:lyvLp9l5XxMhhXkny/s

  Score

  10^/10

  redlinedivandiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1