Extracted

• • Target

    d6798c7b56585e452a3a4c3f28415946286c3ab0c39c359523fd11b61df45272

  • Size

    1021KB

  • MD5

    e5491a663c46a0d4524644af1bdcf7b5

  • SHA1

    74b8475db713091395d6a7647b5acdeed7632dc7

  • SHA256

    d6798c7b56585e452a3a4c3f28415946286c3ab0c39c359523fd11b61df45272

  • SHA512

    ae8305db6e0bc33dd068e826157db5cd1fe916f93c24c80174ced6799ae31211e823208383178f3d57f28e76d995420b28213f46d01082a40f31bb64307da4fb

  • SSDEEP

    24576:MyKXjLaPPH9NYqN8NPs5kkUk3cCrN23gQMZ9Q2:7KXj+3H9NYqN8ycCrN

  Score

  10^/10

  redlinedazadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1