Extracted

• • Target

    1f72fd8ec18f504c83ade71670a6a4a8a4a0b9c55cefd34831dc84d989bc7680

  • Size

    1.0MB

  • MD5

    43f59efb7beb8fb4ff832dac2a58dfa6

  • SHA1

    0cffe401a7e1fbf0fd65aa7f4412e37d4c3d132d

  • SHA256

    1f72fd8ec18f504c83ade71670a6a4a8a4a0b9c55cefd34831dc84d989bc7680

  • SHA512

    8180bd31fdf1294f9ac1ef47f9560bc70493ac0070fc60a107782953934d84952627f3a134e20f07d60810bbe65834bb1fd5f22c3ade8213f90d4c4ad6e197b7

  • SSDEEP

    24576:vyBtGvQ2i4XX5rV4xEm3QeMjjsEw/RuUcr/xzQz6:6BAiySAeYj3qCxK

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1