Extracted

• • Target

    b866397dcd34fa55c468ef01081cee2b9761f6eeea998b3fe5b609e8ca29c6c0

  • Size

    479KB

  • MD5

    bf67c3b553af9e16f492858ccb51f152

  • SHA1

    876fd67d69de7efaf300cc150cdc917e4fc7982f

  • SHA256

    b866397dcd34fa55c468ef01081cee2b9761f6eeea998b3fe5b609e8ca29c6c0

  • SHA512

    da115c700a70d1093715f2b5a55e69a2dd990b2c3a8dadd4e85bd0143c0002551bcd9a98bd510da4a0b11befb449b4985791a465630b16bea52dc56b3838bcb7

  • SSDEEP

    12288:9MrSy90BXThEtYRQ8hx4G6FX8zrHiAtCB6Gi2rn:7ykXThEtYR3lrzGDrn

  Score

  10^/10

  redlinedivandiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1