Extracted

Extracted

• • Target

    bc94bbe6a23cc5f89cd1effb32b60588eeb051d7b71bea6d98850d445d733efd

  • Size

    770KB

  • MD5

    82bae7fba1d9cd83725e419a8c3f6823

  • SHA1

    5ff6caa7c11fcb60454821390eb6b6978d860a70

  • SHA256

    bc94bbe6a23cc5f89cd1effb32b60588eeb051d7b71bea6d98850d445d733efd

  • SHA512

    3f229a1589664b727601b584295f5dc877bacc7e0c58d70d6cc27b30cd423d179d1e535e9766eba9fd13a06cbece654af47bfb89d62348b0d4490f2312af9840

  • SSDEEP

    12288:XMroy90HGlDnq6upRebfuayc0jQxkdAPTVxdMtTEYPFZUXsQ5FWXgDc+u:3yvDq6upReqayclkePZx+t4YPsp5weA

  Score

  10^/10

  redlinemawamirkodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1