Extracted

Extracted

• • Target

    6817122d5d50abd21680412a79b9da5514fbba3aaa65c4f6c4690157b91cc9dd

  • Size

    993KB

  • MD5

    5dd0a461f947278a3e7e2c6b65014135

  • SHA1

    636c1ea4c851146b7c7b58c5b480bdf3e1c3c9e3

  • SHA256

    6817122d5d50abd21680412a79b9da5514fbba3aaa65c4f6c4690157b91cc9dd

  • SHA512

    7b8d6bb7ff2324a6831d2ad18143e5cfc9db67568dbcf9faf081f42e654a98e1066e4d8b8bdc972822d1460ad1d2d954d2a5c4b0c4ec75a0172adc14977aebd9

  • SSDEEP

    24576:bycyIVwkH4prZU82k6kQoalDIV0iXiJ3VNo6B:OWwkH4pivk6SV0LFT

  Score

  10^/10

  redlinediorarozadiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1