Extracted

• • Target

    876c035c26c56ea3af473f31255153944f3cdba73f126aee56b72935920e446c

  • Size

    1.0MB

  • MD5

    23535d00ce2006737513b83312b856ab

  • SHA1

    4abe8ce9ec18e0c1d76a489d3c410237954b148f

  • SHA256

    876c035c26c56ea3af473f31255153944f3cdba73f126aee56b72935920e446c

  • SHA512

    685c83897ea478f4354c566181b613709738b7a3494eff9fe786e7c850d5455305e460acd1f9992b10a046415e38109a03a9b4e25b3125b261a8153c41fad574

  • SSDEEP

    24576:+yuHHHxA7P9qOV4SAzcxRZIdwah2ONeDbQaL:NmRUqu6cyiahh6Qa

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1