Extracted

• • Target

    0bc00bbaeeea9d04aac010ca2f44088f.exe

  • Size

    769KB

  • MD5

    0bc00bbaeeea9d04aac010ca2f44088f

  • SHA1

    572690f28c8ea0a5f3089f0b5ec73c012f39e23d

  • SHA256

    d639ec3a51acd0e1ccdb0b07f29bb3df7b930266a5ae7396c73fd2a1fe4859a0

  • SHA512

    1df0e6ead45eb140d72fa9f67a0434e0d09aba11c1b2a0ad6d0c105b63655cd30fa8502bfda865a3517e0faef569051eeaaa3742fc5e587b440ed385e4826b10

  • SSDEEP

    24576:vy0JM2BRr3xXXUUxzsaaM39O8TylZZ5WK:6mRlXkUxAbg9O8Twb

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2