Extracted

Extracted

• • Target

    6d586921f3d76be2a1164e5bd1b8588490fcc731cf7f2ac383211ade77a46b14

  • Size

    780KB

  • MD5

    a4e1dee06978c99c028f3031cb8290f6

  • SHA1

    650f1e0a0e56ba4f54c3d74d33091584c447a0ac

  • SHA256

    6d586921f3d76be2a1164e5bd1b8588490fcc731cf7f2ac383211ade77a46b14

  • SHA512

    dd74960f3bb19525cc3e971373445db5dba55792368b489e7c490c3a27507542c357181776426e2f59e06a023719d94320ed53ba558564f9f36f2e6945047f73

  • SSDEEP

    12288:0MrOy90BRSlJxG8aIWatAgkdJirt24qfoIq2fRnrz32+PIFNGDy/:yyKSDc815ogrtnqf7BfRnrLDAFoDy/

  Score

  10^/10

  redlinedaswamirkodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1