Extracted

• • Target

    c686c2af2c145c841522d7571e088b725019b18470dd137f5c06597913bd81c3

  • Size

    478KB

  • MD5

    3279b261a2b559e7ce151b0e4e964779

  • SHA1

    175dea90f5c20ecd55a610e5afc40eadc92427fa

  • SHA256

    c686c2af2c145c841522d7571e088b725019b18470dd137f5c06597913bd81c3

  • SHA512

    34407066392b8dfe9b16c8e98cdc36735a4757eacc3fe4f919b1e8de7b2c9d04a007866a549b3a1140e1370b04c449b49560405bfdceca2fd5eaa1af28aa754f

  • SSDEEP

    12288:tMrpy90M495JP97CSX9/HPMNo7oStA0zA034O:Uy9oC64OlIO

  Score

  10^/10

  redlinemaugadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1