Extracted

• • Target

    2fca3b457b1a010f86eecc7fbf138f8d0cd9ce6dd567a25f98a5efa97ea4b092

  • Size

    1.0MB

  • MD5

    9489a75b0c8dbbb9e5cbd4cff5c22f56

  • SHA1

    4753815dc351a13fceba73c91374471bddf19893

  • SHA256

    2fca3b457b1a010f86eecc7fbf138f8d0cd9ce6dd567a25f98a5efa97ea4b092

  • SHA512

    7b4ee5f9401c17cbfbb12fe930c6705ba934d9778e904ff7547f3aa048d63f6563f6650d62acc0bf3bd386c3a86284e5b815fa286384c9453c6222c6b4dc5f81

  • SSDEEP

    24576:VyV1XShiambgyEXzAC5yVRVSLnlhdI5r3W:wrjambtEV5yVRVslIV3

  Score

  10^/10

  redlinelaxakdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1