Extracted

Extracted

• • Target

    63839e77c3de2f5331c1e8a9b76a9b19688450113a960105babd898274a3c314

  • Size

    1.0MB

  • MD5

    bcdac37281e2262d9f9de08ef4026429

  • SHA1

    01de3d79417eaee832ce291ff0fe0a4157207e02

  • SHA256

    63839e77c3de2f5331c1e8a9b76a9b19688450113a960105babd898274a3c314

  • SHA512

    b5dde4d5c7cc44d3afa9afe5919096298ce38d4c08878c77568b7356e78da6528b9766df294df40d11a2d7f888ca456a90c4f1a307f5aa1dfe66335c144c2d10

  • SSDEEP

    24576:ayqGLaJsnZ00LT2IzmIzSjWHfRsa3p/iwZkB5pns7y0Jfs7:hdWG2BufSYtwU

  Score

  10^/10

  redlinefashmaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1