Extracted

• • Target

    663c4089d8bb1f9c81aff255cb8073483c39119039a7f6a3eb72d3c2f6a35fc3

  • Size

    1.0MB

  • MD5

    bfdb89efed95d63a9c23eb2ce5b88106

  • SHA1

    a1f1bebf879cad1c3f738d7f499840574a6fa307

  • SHA256

    663c4089d8bb1f9c81aff255cb8073483c39119039a7f6a3eb72d3c2f6a35fc3

  • SHA512

    89f8c7a7445375b1f27ec868850a4e9a13fd3fafa45a10b1b1c2489c4ce620630c355c0b0f5c09864ae69281e82a25b7730e95f15611f46cf29f7075d7f15a6f

  • SSDEEP

    24576:Uyx/GOUtKcnE1vaq23FS5yDJ3T1je3tam22T9ijS+c:jJGvKbFaqEFoyNGaUTcS+

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1