Extracted

• • Target

    af258184893956854a5555929dde80d6a989094f1cbc596e9a1e2b97459e12fc

  • Size

    1.0MB

  • MD5

    484218320ac6e07e4c386230ce13ac88

  • SHA1

    9590b886aec0280de985d85b450a4304f7db107c

  • SHA256

    af258184893956854a5555929dde80d6a989094f1cbc596e9a1e2b97459e12fc

  • SHA512

    b6b731dee0d29ef7a6f0077bba00aa2387869b1a5ee333e2f6d7135735620bebedbe478cfbddc983068b4db933c1d265297b99be0f849e14d132edb6b9639273

  • SSDEEP

    24576:8yf/7VtkhFhJq9oPafqBb820EuQqR4z8JKMVi:rfT7khFhJq9gGd2rqWwIMV

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1