Extracted

• • Target

    901f1a4c635c0f505ebf1201ec6c9555bb8b9679d4e157021798144ece353f1f.bin

  • Size

    769KB

  • MD5

    97a5ced48efb49af5f51c66777844c06

  • SHA1

    f45596ba4f68d268b86797a73f6641c152dd04a0

  • SHA256

    901f1a4c635c0f505ebf1201ec6c9555bb8b9679d4e157021798144ece353f1f

  • SHA512

    72e0df53f8a61d907623d09aee458484f8746bdeb7d8133b2bbccd60031594fe3484757faa699537056efb6a077ea77332b4e5dc56bd737f2d6a32876f5ab3f0

  • SSDEEP

    24576:QyNib8Ps0H2PboCfvkeTaFKo2tRJJouOHv0:Xk4PsPfMK2KoyJJMP

  Score

  10^/10

  persistenceredlinedebrodiscoveryevasioninfostealerspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2