Extracted

• • Target

    991f5778f542d066b3a44cf36c75c6b94a0e6d2fde848efe1a45a836d0562529

  • Size

    917KB

  • MD5

    5cc136608bf7fe0d67c4ec2c6d0dcff5

  • SHA1

    039233a962f62723bea3533be9a482ce89049be2

  • SHA256

    991f5778f542d066b3a44cf36c75c6b94a0e6d2fde848efe1a45a836d0562529

  • SHA512

    519d073be39d8f601faa1c5745f22058433e715ab447d37a7a73e3e7fe68721129fb2fde97b2e5640014282d3d1b198e1e9a30d5ea8bd60a7417a0ddf6506ec1

  • SSDEEP

    24576:WyUBJZiuB+QxoBwKgN8HLg5iX6GHvT6WzYn:lqTdxoB5gm6ibvT6

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1