Extracted

Extracted

• • Target

    f07dc709600a2688c7b1771c90a20cdc193075faed95e684195cf48276e8e6e1

  • Size

    781KB

  • MD5

    542d9c7303e281dc3abb8d96cffc02e4

  • SHA1

    585e4a0e8cd4c616ee2e68e6910a660c6a05dc9a

  • SHA256

    f07dc709600a2688c7b1771c90a20cdc193075faed95e684195cf48276e8e6e1

  • SHA512

    4a0e08bf9abec06e886f165baeb5380b879f8979c39a88447ccd67f5963a7a82c0b2445e780c6020d839efe0912bcb39a1a8de1e21df7e14c430b7b224d6e940

  • SSDEEP

    12288:LMr/y90rEjR4saWk1I3jmL3q24gOIuKtByYHXmGfUoBSO/D8ma0U:wy8E94sCZr/6KtooX/UoBX/DS

  Score

  10^/10

  redlinedizamirkodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1