Extracted

Extracted

• • Target

    bc9e01f1e1779a88d3c0ac291e97865ddbb4757e4a89dd43a998f7ea52aaf51e

  • Size

    771KB

  • MD5

    afb51090a7bc3ceac498d786d55b48e4

  • SHA1

    649b79e7b9590de1896475d3d61d04bb2d720df8

  • SHA256

    bc9e01f1e1779a88d3c0ac291e97865ddbb4757e4a89dd43a998f7ea52aaf51e

  • SHA512

    4c36e3b3075b1f5f2950c1876b59570216d3ec8ee4f804b56e95d55b8d278df59f9521153e7b27bd7da2ce904fe5bfb00c6fe885610862596a8fac8d19e85a35

  • SSDEEP

    24576:yySDVXZWX4VAvelQ50Mu26+83lm8o3k3FSSDD:Zfvt50MRMQv6cSD

  Score

  10^/10

  redlinemundermusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1