Extracted

• • Target

    47d3c43ddd7be15a90c55d2b4d6fa409fd83fd8f1f428577d60cfebe665b5773.bin

  • Size

    769KB

  • MD5

    b35006b1be31a95645817080db4b9611

  • SHA1

    4576e27214df83d661750914cd7513730b7c59b4

  • SHA256

    47d3c43ddd7be15a90c55d2b4d6fa409fd83fd8f1f428577d60cfebe665b5773

  • SHA512

    64c457ee8010f1dd6fff621d5286af13f1ea93b19275d43dfa97c0e912169e1ddccb679e7980b6dac248c97392867e2886ec6c1bf79d0bdd23a36e76b1ac340a

  • SSDEEP

    24576:xyRApyxeNPh/EXBFiiaiR3V9QahRXggjx:kRApyEh/ur/13VfVD

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2