Extracted

Extracted

• • Target

    9b78c38c42409e5ed2dd01f0234078dc2c6b776551e48e41d10247b219ef9698

  • Size

    763KB

  • MD5

    a20713d345f8b567e5b58a88c9f04f6b

  • SHA1

    c628db7abb908a200f1a23ef9d796f806994f8df

  • SHA256

    9b78c38c42409e5ed2dd01f0234078dc2c6b776551e48e41d10247b219ef9698

  • SHA512

    710c27898fcb942e6d682f4b5977f9c2e58ca17dbecead63b1c404c0e4295e3da32237516f652d6eb64bebbdc7e11c35753c25dba46ff598f5421fec70589c9b

  • SSDEEP

    12288:TMrZy90zdMcOai3vdUFfWwaVsOR8EtG1JiFXMKbvNc34dBPmdqLByEZ:eyGCvdUJkyOR8QG1aMKxm4fPmde/

  Score

  10^/10

  redlinedisagogadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1