Extracted

Extracted

• • Target

    5b46bec7e6572fa54475ce654fa5045bf9dbfc8789dfb56ecd63448e5a9753ce.bin

  • Size

    875KB

  • MD5

    22bcb277131dcc3151c5afaac1369543

  • SHA1

    97a400561a60666d9d72be05efef7e05229ddda1

  • SHA256

    5b46bec7e6572fa54475ce654fa5045bf9dbfc8789dfb56ecd63448e5a9753ce

  • SHA512

    4e42cfaec6e78744d33e71425bd559818f940c976382f17d42ceb98423d343cb41244fef5f7de3c34ea76de87a1aaab9ad0085d67dc097e3977104b413132254

  • SSDEEP

    12288:1MrQy90ZCCJp0kelBOG2V2peaOZJiqWAKxunY1HmBqTkyBsclIDeWr94XE4w0bis:5yAX2p2+eaohmuHgkyCvx9wlhFzTFz

  Score

  10^/10

  redlinediorarozadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2