Extracted

Extracted

• • Target

    1aee6e4906e33fab4d3906017b480418914fb1b7b7ed6305de551450fb53fc81

  • Size

    764KB

  • MD5

    825e106ccb45226092a0314ef16e8e5d

  • SHA1

    565619d4b284cae2c6e1b04854557482b2ca326c

  • SHA256

    1aee6e4906e33fab4d3906017b480418914fb1b7b7ed6305de551450fb53fc81

  • SHA512

    f59af65edd15a6fb5899927ff2984da993de48b81735a4971bae7fb194b1b9f5be6b124039c653ae76bd7fb420450468179ebc23049afadbbc97cbd25001621c

  • SSDEEP

    12288:1MrZy90BD8y/MuL42ffLG1iUCbzZ/K/+lC6lwf1zifVMm8i+LOT/w7g0D7oH7Sqw:syaDb/MYmi1bzg2w+OSQOT/wsg7+up4K

  Score

  10^/10

  redlinedisagogadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1