Extracted

Extracted

• • Target

    c3b5e81dc857160385819138f203f445868a49b38bfe494c6694e6b68e5dcef1

  • Size

    767KB

  • MD5

    907c548949d9bd43ec6ef24dcd459748

  • SHA1

    d81eb119963b3a5ff2db7e9fc65fa885f3688182

  • SHA256

    c3b5e81dc857160385819138f203f445868a49b38bfe494c6694e6b68e5dcef1

  • SHA512

    b64f28d4d0fe85cf84d4e536b0294d566d81f69235ed78201e511006fd8310398167eb0a3f1f720a905a0cc0323007d6a934f956d40dd1d610bc847d68e59596

  • SSDEEP

    12288:yMrBy900wlrlXlbc/QpmAxLYQ4Rh2ikfbkoWq+fZAxYP3an0kBDFnMLtIW+lEIl:7yBwrl2QpVlfbjcfZDP3a0kJFML1+z

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1