Extracted

Extracted

• • Target

    dbc433442a4e215dae07aa09fc2f652116df2a2ebc52216d067e2f6ee85b267b

  • Size

    1.1MB

  • MD5

    af74fa792ea1aaf0d4ebaf31a3dbd4ce

  • SHA1

    ce6631e05a55115a6ab9f49c124c8a97a89b2f20

  • SHA256

    dbc433442a4e215dae07aa09fc2f652116df2a2ebc52216d067e2f6ee85b267b

  • SHA512

    7036cbe83751774fde8b811e45f43fc86d1bb51ef96e4efd169c944effcbc407b4f77f7e68154a1241c051abd50392199d3efd52269a331d07fbf03d2998821b

  • SSDEEP

    24576:oyfxXS5yZ5VdIc/SmqqC/mapxVJJy+NIRdhJAACKF:vfxyKdVAqC/3xVJkqIrhJAA

  Score

  10^/10

  redlinedamasisterdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1