Extracted

Extracted

• • Target

    88153fb8da8046a4886b221b1a0abc702dc65a1fabcc5702d85d6ce517d051c8

  • Size

    771KB

  • MD5

    a38d9929f4c9a32f7189cd3059bfafac

  • SHA1

    f6fd2c7c335a562c347f621a674ab018cc31099b

  • SHA256

    88153fb8da8046a4886b221b1a0abc702dc65a1fabcc5702d85d6ce517d051c8

  • SHA512

    2fe116304f7ad89fdd57d6f840fe6313b7330022518766d3bb5b1c4b672057aee4ce198990e7ff0680376cf600bddb862f79784beae9ea8de7485587ed82ad59

  • SSDEEP

    12288:/Mroy90d5hRl8JdkidmTG87wc9GZpjwu5xxp0jym8T973+cULk3NTrSVX:/yC9l8JWnTG8ipjwAm84hk31SVX

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1