Extracted

Extracted

• • Target

    d5e3971507394422ca9b4cc73f24942d3ed009c627d80880aef890eb30d3ce10

  • Size

    760KB

  • MD5

    71b602c19133ab79b392d53b65b4a8c3

  • SHA1

    481a0cc28a33f4b124e7a44e94870a952af306f1

  • SHA256

    d5e3971507394422ca9b4cc73f24942d3ed009c627d80880aef890eb30d3ce10

  • SHA512

    80e85acdf740b3cb4916b58c21d2a8aced3df45bdd5902ee7dafa1114f4c55d291f0a5be69f86ada37bb859e785970b25b24b944818b2f7fc647615d56929cf4

  • SSDEEP

    12288:IMr4y90kFfgbDoQ57YUo9MTkf38hJx/nVGFXVgYstLGi6oAhNFsgda5FB:wyb2HP7eosFX9s4D2jFB

  Score

  10^/10

  redlineduraheroydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1