Extracted

• • Target

    c3433710d0bcdba512ef928f6644530682f27f644da925a8ae4498e7d8c75ba2

  • Size

    770KB

  • MD5

    9ae29af90b464dbf14b526b227d169ba

  • SHA1

    49688be6efabcecabc2909182c53912887b28b3c

  • SHA256

    c3433710d0bcdba512ef928f6644530682f27f644da925a8ae4498e7d8c75ba2

  • SHA512

    c5f7f1c89c64fb0ca59cac01a031681732dd513f655c57d8ac577361e1f3f84dde12836578489298f9dcc6ccf798f9877219cbe941aa4084fd5f84cda08948ec

  • SSDEEP

    12288:HMr1y90i299TgxmbIRJ/V3kR4IoiKXEKRO2uaxW5lPH0f55Ii4qCWChrcP:Syh299X4d3WtoiKc2uax6Hw55InqCWh

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1