Extracted

• • Target

    e63027fac1ca70e18fcda7bc1d347cf92411f0fca9ccf943642887a97feec457

  • Size

    1.0MB

  • MD5

    90b5652f08d0fa4b52729e29173b9c20

  • SHA1

    9168d8a34ea8c92f1d27bad4c5630b2f4712c8d9

  • SHA256

    e63027fac1ca70e18fcda7bc1d347cf92411f0fca9ccf943642887a97feec457

  • SHA512

    c56581e0ec557d025a0c40d498285b8e8e1105b318b50e1c7e9bcbeb646ee3bb329c96453d0b2cbbfdd936e48be58b58efac93bace913ac917b9bd56f5721088

  • SSDEEP

    24576:Ry3tYi1qoRl/Yz7+R+VNQpwtEzulQ+KAH:E3Kqqof/v2QBu6

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1