Extracted

Extracted

• • Target

    72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

  • Size

    768KB

  • MD5

    e33d44f2601164dd4462aa14a84858fb

  • SHA1

    4f969ee7d62b0bea719e773d16a6e29cbf8e9d9c

  • SHA256

    72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

  • SHA512

    e89cdd7eb024d8603d6721a61bff0e42ab6f1cedecaca33a4563ae54173f65cdea69a57e65a4f4ae214ce27f5d94bba21ec25feb91409be7f4f970fc6fcde933

  • SSDEEP

    12288:NMrky90xAGd1fezFAFpLq2tMtfGRJIr8K2n2ylUl6z9Wn0kBiinMLtIW+BEWJkY:Jy+L1fezqFpW2tMtfGR6mnUlM80k4iMm

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1