Extracted

• • Target

    869c3e2a7bd607387b935b5a3605c2764631a678817c5aafd87b40608d43ac1b

  • Size

    916KB

  • MD5

    07fb17303d18c40b702cf2eb7a8f607c

  • SHA1

    8f2fcfb0b0d371cd1944eddb7560828cb8f8c244

  • SHA256

    869c3e2a7bd607387b935b5a3605c2764631a678817c5aafd87b40608d43ac1b

  • SHA512

    96c9d00102f36fd0999dc40de2048750370ab3f1d0a913978d3a5d92e422abae824fea6fa7aa9b11e020fdd112794acf27fb1b509c078e01e245ff11aa932239

  • SSDEEP

    24576:ZyAnwL54v4O8b2uOS+8lio78tjZ9pHti0VOxGde:Mmkur8b44iGS9eOOxe

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1