Extracted

Extracted

• • Target

    0bdb01bcd92d7f3fc047d9bcc2770591d82615e0b4b7662d4e1b4267dc921dae

  • Size

    1.1MB

  • MD5

    4e289f7010e6821bf28253938a85cf56

  • SHA1

    ab06b14c698cad7e23e8542ed1e6d7a3b934f9ad

  • SHA256

    0bdb01bcd92d7f3fc047d9bcc2770591d82615e0b4b7662d4e1b4267dc921dae

  • SHA512

    2cbe95792ca2649c0628fc348944378a3f7f5b9ef09df4383e6f69931f77b893be48cfbc636aba9599ff4ade6034b8c1ef1d3ab3a8b9dd4ae6538486d4d6b2ee

  • SSDEEP

    24576:UyF0xQHcgUb37qs1Is/SsoaOwGhVEKMXVcjUy93z8:jFCQHRSrtZfonA3ijU

  Score

  10^/10

  redlinedamasisterdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1