Extracted

Extracted

• • Target

    5841dd085be442a85d76de0b91044826ad00cb586e2cab646f638c3460c77bfb.bin

  • Size

    885KB

  • MD5

    bf32ddde84500046bf1d33923fe9e15e

  • SHA1

    9b2132e500a341d19ba1463e04de04c0fb2750c9

  • SHA256

    5841dd085be442a85d76de0b91044826ad00cb586e2cab646f638c3460c77bfb

  • SHA512

    4195fe6ca5db25868a3be04e913ec0a8e0f85b47c50ff9717e9b294e3f3a088455bd1021c6a49050ae2522de43b3231c57972a4c3bab845c4042b3759ed0791b

  • SSDEEP

    24576:jyQ/PsUHGXwdr3d5IBuWwe6tBaweU/Q8amo+Z:2QsUfWZ63awewamo

  Score

  10^/10

  redlinedebrogogendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2