Extracted

Extracted

• • Target

    6b942a7710ea8f501c40eb6a64e27a04d02cd40764034565d182cff88defd844.bin

  • Size

    885KB

  • MD5

    b1fee4cd1dc36f3d014c8ed2993abe2d

  • SHA1

    74ef2d3a4f7204f10d1e177ecea409bd66694d68

  • SHA256

    6b942a7710ea8f501c40eb6a64e27a04d02cd40764034565d182cff88defd844

  • SHA512

    728309e012392621918feb89691e27879b0a27c8fc2e8c140ae052b524139feb87bd05ac5183b38a5b3bf6a28e803f78a7ba61b3cabf64dc18667b6a8aeb7b66

  • SSDEEP

    12288:wMrky90R5jFLBQYSYCWVEh1di3AhJsNjLpDxtZAkm0zu1yHe2GEkQXzVhtKsbpy9:EyQdBrCEf3uSNRrZ6yHeRYAs7Tc

  Score

  10^/10

  redlinemixarozadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2