Extracted

• • Target

    4dac11abfb1415e2649ed24e3c908bdfb5cdd0ab8e25ee8b424bfd31eb66717b.bin

  • Size

    770KB

  • MD5

    6b57137c86c2ae1411c4ce0051211e58

  • SHA1

    2b2a8610df3e5dfddc344d913157eba6dc492ef7

  • SHA256

    4dac11abfb1415e2649ed24e3c908bdfb5cdd0ab8e25ee8b424bfd31eb66717b

  • SHA512

    5795cc780f7791c6615633a71e13605ce2e0658eab93374ff4870f9e1e906dc3f2dca63290634867c698cfcce750d8821b9c435e351d1f83015ffc94d559b895

  • SSDEEP

    12288:YMrby90xS6wPieBTb7O/A3D6yeJ1wqU6T7CK/OvRaWuA8GgRsw8isTy2QFm:zyG9wPD5PsAPaKXacvRaTGw8DQFm

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2