Extracted

Extracted

• • Target

    ff10709bd7c25574c64ab5482ea271335f75f8ad7d46610e854bb81c2adbc719

  • Size

    764KB

  • MD5

    c72c0ec1e50e3200aea733b2d9f37d46

  • SHA1

    8dfb8110eb9a1c7889ac9007d868297dde1aeea4

  • SHA256

    ff10709bd7c25574c64ab5482ea271335f75f8ad7d46610e854bb81c2adbc719

  • SHA512

    61c07870889bfd5a0aaf65693097b5eb68487617c78a2363375991dd3532be8b3dac4fb59a973f811af3e4501fed602f9a821eab3763a8fb9a1e958c0069fd3e

  • SSDEEP

    12288:eMrby90tccK2LzfCByOfjN82D2xuOIA+sMMX4PFNwH8w7XDcYmMkB1TnM6tIy+Wo:9yIcNC0HN72xuOIuYty7bDTXkDTM6J+j

  Score

  10^/10

  redlinegregminadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1