Extracted

• • Target

    d076688386bc3381bc573aa80fada877d6235856fa536a515f6b36035dd48c96

  • Size

    1.0MB

  • MD5

    05db2ba4cb99222e7a5f969e91697b74

  • SHA1

    873ddb572efe1434ed5429e42f3092d0c3aee16c

  • SHA256

    d076688386bc3381bc573aa80fada877d6235856fa536a515f6b36035dd48c96

  • SHA512

    35451c718c10351f16d4ee729c4ec5efde4d848298cc7cff47477bc4879ba01d3d7425cd4a0730de091c0cefb0a2b3c0e27581052147532c22df6a01d049fedf

  • SSDEEP

    24576:py1J21I743SBBn4PUDXEdopX0tpj+6nRXuAvV90zsfN:cj21I7Tnf0dop+PRX/v/0U

  Score

  10^/10

  redlinederendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1