Extracted

• • Target

    a64332837a7834d7b0679feaebf4c8988af261c10de78c8d9b7b3efe0db75c28

  • Size

    1.0MB

  • MD5

    28bb4144242924b5886029e989b365ef

  • SHA1

    39784ffed7fed2a696c18fa0e2d7ec8a645318ab

  • SHA256

    a64332837a7834d7b0679feaebf4c8988af261c10de78c8d9b7b3efe0db75c28

  • SHA512

    ae9e4332f08aafac2a157f7c848e1cf1fdb3076e902e617882f987be403cf86ca209ac17f36651549f2979e737b6f95cf88ec9bf5f768aeb08ca23fed4b728ba

  • SSDEEP

    24576:lyaXtA5T1+Cfhl8eKMlkXYRNlbgbE5+OPdFXe7DkWR:Aa9A5T1+CZWeKXXY9bgc+OPdF

  Score

  10^/10

  redlinedreamdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2