Extracted

Extracted

• • Target

    9c217d7d735dd251983a7c72e9de770db1023f49145e6b26ec941b2094bbd43c

  • Size

    770KB

  • MD5

    7137eae5f175aeef54e767a3b26b516b

  • SHA1

    2f2cafa5fafc8a7e69905d076cd54bec95eca879

  • SHA256

    9c217d7d735dd251983a7c72e9de770db1023f49145e6b26ec941b2094bbd43c

  • SHA512

    e844d1ff2a6ba0782305d377f149e129d2e7644bc610a9f38a4e5665f0bdfef82e66385295accefec9d8e150fe35bc0f63b4e493f0d75d9c91ca1380118a09d8

  • SSDEEP

    12288:kMr6y90wR+8kocWfHJpdvjz1a4J+s3BAwRcp90R7h/qkT/kmja09U:OypQo7f1vjzM4Jr3Bs90rVbrja09U

  Score

  10^/10

  redlinegogamisadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1