Extracted

Extracted

• • Target

    4c893a5bf31705f409ba7e37bb7db49cc9f8ec039e2f21ddee5a563565952dab

  • Size

    770KB

  • MD5

    19f3fb77d9f90cb200da1c9f116f9561

  • SHA1

    81cca86c0fe3131b0162709a39e5f3c2daa51cbc

  • SHA256

    4c893a5bf31705f409ba7e37bb7db49cc9f8ec039e2f21ddee5a563565952dab

  • SHA512

    0c46ec99ef6bb74b0476969d707508b4824990b35f836be402101f5546b1b18788748544a8f246eb55e7b14a0d22ac0d21fcbb7ab5a11a4e2233aa18055bcddf

  • SSDEEP

    12288:cMrHy90RCla0JfHvzRh5jO+IlsUD1j8TVOA+aV18tnK8f9R3+NJLk3NTNSKh:Dyfk0JvvI+IldpwrUK8uvk3PSk

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1