Extracted

Extracted

• • Target

    9973e15bd2fda46d0ed3568adb4a27557920a1a22e0b5caf6d0622355c2bf939

  • Size

    770KB

  • MD5

    f7f9811ccf0b4a22ef8f30cd67afa502

  • SHA1

    962be77cc0b1815294eb1a593469094ee67e1a74

  • SHA256

    9973e15bd2fda46d0ed3568adb4a27557920a1a22e0b5caf6d0622355c2bf939

  • SHA512

    a5316d51039c5b8411043ec758ac9e9b43499ad857838fc068d4d558861a9b281b79ae20af9cac4734cf7a208b7544e414a8d087df170bac3491ced25ce5ad35

  • SSDEEP

    24576:SyUT/MDhwX9PivGyJtwmKTwOFlJTAIGTUh:5kKhwAvLtAlJY

  Score

  10^/10

  redlineheroymuradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1