Extracted

Extracted

• • Target

    e8746a37d1389b3c1d722c790501d9e5f9a8c94af218dccceb17eaae05975bde

  • Size

    1.1MB

  • MD5

    524136e2377c536c2586c9971ccc5d9c

  • SHA1

    8a23ed99e5680a68ff5b9a346dc895fc16dd2acc

  • SHA256

    e8746a37d1389b3c1d722c790501d9e5f9a8c94af218dccceb17eaae05975bde

  • SHA512

    ef9f730a227a7ebe4c9030209f84a9e92523d59b7636b2439b481eb2f7c208b8adca79afb40da9361e4e976b52e2dd29a14a74cc7de1018254d928c8c94ec638

  • SSDEEP

    24576:FyIvtXvTuL03T9Py6plEClrbT3uvSkw1Fopzy7I6hc2JVoACngc0o:gIljjdbD3u67FSG7I622HCngR

  Score

  10^/10

  redlinelukaterradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1