Extracted

Extracted

Extracted

• • Target

    2268d36d153d1bce643a2bc606d17db7feb757b8581c377b9057e066fdac08c8

  • Size

    1.1MB

  • MD5

    d558b18a74e0f6f7d619492e45cbb274

  • SHA1

    916185fc0018204e7fddf6ce0c5e81895d149426

  • SHA256

    2268d36d153d1bce643a2bc606d17db7feb757b8581c377b9057e066fdac08c8

  • SHA512

    d9f191a5324b4e903c35d4208ff0288fc55224b6a0ccb6233babad6e7f08e23b656e7c1d85be3ac33637b987a46f97bfad3994e022ef90998a35906d33ac2b35

  • SSDEEP

    24576:tyeDXveaXdvuSTINCObp0uymwNRQwq7ZTnnDu:IezdBTWCsp0FRcpD

  Score

  10^/10

  redlinedogmamotorterradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1