Extracted

Extracted

• • Target

    ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

  • Size

    766KB

  • MD5

    111f0b3c5f6af70c4ec9c56fda83d7b1

  • SHA1

    2972ab1e9152143697e36922a5a191993b0fabc4

  • SHA256

    ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

  • SHA512

    260a96326c8fb159d0aff30947a7a781992563f50e8ee680184e583bb15dd901128897215bbb382e13efd586efac29f8d0e7f551508efce668e672652574b74f

  • SSDEEP

    12288:XMr3y90nFUWywLylG1Jfzr+6Itsr3vQRm3fc1RmWIArWbUI6FLvGkBkunM8tIW+G:wyqUjlG7P24e00RmWIAad6RukiuM81+G

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1