Extracted

Extracted

• • Target

    2f07cef04633592682d33575281351e1da542532f01a756385427faca3681c18

  • Size

    764KB

  • MD5

    56b9748c3996bb1c0a782aab4d4f8dc7

  • SHA1

    38b52402a2c9aae600d021311137fe56d0be6897

  • SHA256

    2f07cef04633592682d33575281351e1da542532f01a756385427faca3681c18

  • SHA512

    a026109d848a721fdc4ef0e306a7a5f1a3964d381a017d5edc49f71e2796fc0b741ebacdba94798ffb8c99d581582ad02bb53c6e1e1bfe555a4c5e6c6f582d35

  • SSDEEP

    12288:wMr1y90gIuW+Umwn3HP5Yb6rMFa9zZAwBSvxjB3B8bimBu7J0mp4dBJmd8LB7ELO:VysCw3PhdygSvxVB8b6J0a4vJmdoKTI5

  Score

  10^/10

  redlinegogamisadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1