Extracted

Extracted

• • Target

    5de4a1f07f7d671d2c80bb123158c1777fe3864bd87e23aff7242beb2f2873f0

  • Size

    767KB

  • MD5

    e3cbac116190a5cb8d7efaf821ee7ec7

  • SHA1

    6b50b671fea28f6a5b6f8f9fd51e6eafb8bc79d9

  • SHA256

    5de4a1f07f7d671d2c80bb123158c1777fe3864bd87e23aff7242beb2f2873f0

  • SHA512

    6a63b929c8418711f34f3ecd7961b2509926858bacf1f5de675c996ad07ed99f54a22d22ec4b884586dcde4bca446ad2cb6912c9dd5c8945d1cebc46ab478738

  • SSDEEP

    12288:JMrBy90OqyoVGcawU1A/NxUo0sEfY1yu8v3C6AravZlBCt/n0kBQ2nMLtIW+SEkE:gyPGQO/QHY1hE5jRlBCt/0kS2ML1+V

  Score

  10^/10

  redlinegregminadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1