Extracted

• • Target

    3df2485dce5e1fdd4d167305e7df4d1c81ee4c1bb65f2f0655a5d7ca0e0069e1

  • Size

    479KB

  • MD5

    64711001d5fb8a9612da4cd4ef058784

  • SHA1

    477da19eda1530bdb1d7a9e77fb6af43edfe1cbc

  • SHA256

    3df2485dce5e1fdd4d167305e7df4d1c81ee4c1bb65f2f0655a5d7ca0e0069e1

  • SHA512

    8f9e43d5fb28952cb570ec26d307c5a8c6b1319a6ef13600b4642cc7c8c3645e92ace16f78464e7a1dcaa3a9d3ab70b45f1f4a777a0113288e9845605cbf906f

  • SSDEEP

    6144:Kyy+bnr+Cp0yN90QEYXOWuyCFfos+H6lnaKzOUtWS64OfV75TGzCyelcSjbfVbTn:KMrmy90OeBy8w6ZgLTGgrVPc7jue6ek

  Score

  10^/10

  redlinedivandiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1