Extracted

• • Target

    af08a124c35bdbb81adf8cc7a466d6bd2fa0b2ae29e140ee5dabd60a2198c5bb

  • Size

    1.0MB

  • MD5

    5551d0bc3d4bfcb08c3265ddc6164cc5

  • SHA1

    931cfad6c1c40ee23bd0ea514f81f6f35b432e0e

  • SHA256

    af08a124c35bdbb81adf8cc7a466d6bd2fa0b2ae29e140ee5dabd60a2198c5bb

  • SHA512

    0e18303a4bc0e9dde1843133621fc646e1810364acee43540dbd33f05cb932fc966c6a1053fc6aafdfc2e2d939ecba0c546d48750d8e61cf5011592e47172bba

  • SSDEEP

    24576:/yJ56KGMzyuy7ynQdOEVoVZgB9X2KAMUZDA/3sN8qX2bsK9:K76HMOXswwgB9X2KAMQD0zj

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1