Extracted

Extracted

• • Target

    948622fc2c2affabc5155a80ad15072a11fc1056caedd5b19e89e3a7279678a6

  • Size

    752KB

  • MD5

    2d5066ef791874fcd72d0f29940b07d7

  • SHA1

    71781843b609742e0ae173ae21ce8f05af019215

  • SHA256

    948622fc2c2affabc5155a80ad15072a11fc1056caedd5b19e89e3a7279678a6

  • SHA512

    f6b515906e619d066bfc52b0ca4f875b7777322be635d6624b0539f9b19c98e1c3c964881943dec81b9051a76459b92e2b4baaa311f8596f2f572245ee1f37e9

  • SSDEEP

    12288:fMr9y902cpsP1vNlvcyu8j40yKkU6VjEa3vpt0WLc7V5yPB2cdsZ0OWXPOjuFIuW:Gy3cpOvLfjTyKiLv41V0PnDX2juOuLy

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1