Extracted

Extracted

• • Target

    25268619c4d290dd8fb6611da290468cd42b56c9d9cc39ce65cc03023439881a

  • Size

    1.1MB

  • MD5

    04aa99f89bfc5bf61daf9449c55db3a2

  • SHA1

    ea4e5c467adf6f46d5026e163f40b93cee25f152

  • SHA256

    25268619c4d290dd8fb6611da290468cd42b56c9d9cc39ce65cc03023439881a

  • SHA512

    5ebfd55ef6a1cfa421cc7dbc79048be21041ad7a82f62c34cbf0e0d82b5e82a0e4a844566ba431333dca7765e89c0ce86ce5c67848154b068c69f7c27b138330

  • SSDEEP

    24576:kylyR8qsU7q9LnBQpYsmeeU5utIGEgcZqrdm9t5XdeCju:z4R8q+9LnXsmPouewmTXj

  Score

  10^/10

  redlinemuzarumbadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1