Extracted

• • Target

    9f956eac8e653ff5369025d060ba704301f1ff6b5ee81e48cc81859586cac188.bin

  • Size

    770KB

  • MD5

    6e11ceada60ecca405c587aff12f126d

  • SHA1

    b651e337ec6e151420a1f75e9adee8288142688d

  • SHA256

    9f956eac8e653ff5369025d060ba704301f1ff6b5ee81e48cc81859586cac188

  • SHA512

    d178883789750ff810830b3e3c04033a4bb0c1f798a4d0bb378fb1438c0716307695c71a5a916fe9ac6781cf8681f687c26dc64becd20b0488a7bad9e59ec917

  • SSDEEP

    24576:5y4kJcBSVSFzezq/EQSSj9ELKgpT+A+4H4:s4kJYSVSFzrS+ATHH

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2