Extracted

• • Target

    849e5fd718bfa964bff8b3d0138acff618484cbc27fe11b35250e9e58f7263d1

  • Size

    479KB

  • MD5

    0547a83973f12ac4149616406dfd520a

  • SHA1

    252f8b3377e0c0bdd4af2a2f85758398fd57c6cf

  • SHA256

    849e5fd718bfa964bff8b3d0138acff618484cbc27fe11b35250e9e58f7263d1

  • SHA512

    ae13b702876822b153ace55d4c6ad287f909079a466d97f12d2bb2c17b52a4086d4ec05d5e67f9f17b67385dbad836f920712d4bf305351f876bbb17dc3b36a3

  • SSDEEP

    12288:NMrcy90PDuQlFxQNtn7vD3QZXH0szSX7+Gn/cjSAj1k:xyyrQNlvDqEwg+E/5u+

  Score

  10^/10

  redlinemufosdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1