Extracted

Extracted

• • Target

    4b5ae5660f914155505f062e32fd7e6f2e68aed403781a99fc84bb54cd521b47

  • Size

    768KB

  • MD5

    e239f21da6e0fb9efcc81370463e4d93

  • SHA1

    26b7c2637495754f01378854ce243cf2596f5f32

  • SHA256

    4b5ae5660f914155505f062e32fd7e6f2e68aed403781a99fc84bb54cd521b47

  • SHA512

    8c254784455b0232949ac251e8c0cf3a4f103a8c7b9672b58e00545168ad9ea2dcb974d0a1dda8ac56af41f9b2679f8110755f094308bc6fcc2d48f50bb9094c

  • SSDEEP

    12288:kMrOy902BRy2RC1C4CWgdaTvnG/t40qgNZJFHzlS0vGkBTrnM8tIW+UERG9N:iyLnyQC1VCWbv+4YFJ1uk5rM81+4

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1