Extracted

Extracted

• • Target

    1fa55e3a1933550130b75137e94f512ef1a0478117ade16b3be2248eb1dbfd49

  • Size

    768KB

  • MD5

    93661e4766ad3cbc0fdb6c61bd2dd77d

  • SHA1

    bae7ca3267a669b812e0d01562683dbe4b30f8bb

  • SHA256

    1fa55e3a1933550130b75137e94f512ef1a0478117ade16b3be2248eb1dbfd49

  • SHA512

    5ab0b679815a25da0e71930a3dc4e43a25ac6bf252b511af51ab0104a7191f0a546d31d3700e6b08038adbcbf102b489dc9d93e372f3f4af789adde726f5ab27

  • SSDEEP

    12288:ZMrhy90+3tn9qiAZ5P32YxaymU3Nd8GO/4/TWEsvXsJ0R+Lawr+n0kBL5nMLtIWI:cy/nYrZ5P2Y4ymcf8GfTW1XEXa0kB5Mi

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1