Extracted

• • Target

    e5a33b518d02737644444a118116292aeda5597febfcc5ab091f559b05724fba.bin

  • Size

    770KB

  • MD5

    a267cac92a7d8c43308cd9a2bbc68f0b

  • SHA1

    9cf8385f042712980c475e208e9529b6097c4a33

  • SHA256

    e5a33b518d02737644444a118116292aeda5597febfcc5ab091f559b05724fba

  • SHA512

    c755147d48de1b3aceb1725e5ddde887e768f677fd5caefd7881a6fa48d1f639272e163222ddfae50182c82a1cefc793ddb18703965d9e6e6f04936c5f2399e7

  • SSDEEP

    12288:lMrXy90iKSgV31dJPTyaopW0XVWCKQfprqVXumgNEBAS6H6npIyXex0:2yhKSAPJPTgpKkGVXcNEeHH6nplXex0

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2