Extracted

Extracted

• • Target

    ed9ead97a08b2f14a9501dcbd9af96f61b3dc35d089834901bb770e771795f31

  • Size

    771KB

  • MD5

    2da512566250900145e64c998d48aba6

  • SHA1

    33162940e52862d2a9a97cdbe8b5d93af8a3d35d

  • SHA256

    ed9ead97a08b2f14a9501dcbd9af96f61b3dc35d089834901bb770e771795f31

  • SHA512

    99eef9bb7a53d53ff57709f1d6a4f8a09fda04f05d0e199a65a4c07cad6fc5ada72cbbf0bee83739c8cd7984ff0fbb75e5114907670e68913cf107b85fd5df52

  • SSDEEP

    24576:Jylu4FjwgF76aNEQaF6RRxkm8dgk38S1:8pNEhF63Dubz

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1