Extracted

Extracted

• • Target

    5706f55f5dad3c65521d05f27915e60387bf4cae60cb72c964cad8eb85b8589d

  • Size

    770KB

  • MD5

    0f81eb47ff6767362ee93ed174c4b313

  • SHA1

    13e06c02bc0e8637485133194301631a2e2a3b47

  • SHA256

    5706f55f5dad3c65521d05f27915e60387bf4cae60cb72c964cad8eb85b8589d

  • SHA512

    155020d6e71b33a56e812bfd55ee6d0dfda3e6d89bb7c1f04f6614c4ccdba58d92c94fa56c661ef13eb3fdb81fdad1fd026416b9a3c9582d5e6d1f7c59aff3e0

  • SSDEEP

    12288:eMrDy90I8bMEJ4K2CIEoQMyLxG2+XOW9qZJYUolJz0r3rQjZ3l/fpHnwI7:ty6GCQ9R2+cEFlJs30dBpHnwc

  Score

  10^/10

  redlineheroymuradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1