Extracted

• • Target

    8529cf9ed6b2bc21b55824bb6947d330ffbc4c9788a85e2ffbf6d8c430101c93

  • Size

    1.0MB

  • MD5

    a192f722533906e1e7a7111bf0094cfe

  • SHA1

    df23995c0e9f99beb47a20a3b33a77e135207e05

  • SHA256

    8529cf9ed6b2bc21b55824bb6947d330ffbc4c9788a85e2ffbf6d8c430101c93

  • SHA512

    fcc5ff956eea14290a5a139a6bcd9544a03daabeacd271a590fe5a16ae75ae4ea8c54fb968079ba9032294d863cd50e47ae1943a81dc70ee2dd009195c3cbffa

  • SSDEEP

    24576:VypZzzoff6XgC1rib+A2OWStipTac1nMIaicX:wpZzzgSwa+pSR1n7ai

  Score

  10^/10

  redlineduxadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1