Extracted

Extracted

• • Target

    9321efc88cb6560ce4a93be320f9af6890342ac3ce4cc72c0077011ebfc4ab6d

  • Size

    805KB

  • MD5

    e714caec9d0bc53f3c82dfeae0e62e3f

  • SHA1

    bd00f4e2d3c5840f033575e846fb758e3d6480a8

  • SHA256

    9321efc88cb6560ce4a93be320f9af6890342ac3ce4cc72c0077011ebfc4ab6d

  • SHA512

    6dc4cfc6e0e1dafc2c2a253c1e2d520b8b5755828f3c26d7dfafda5d51c91ec64e12578f3f53de4ce3a243fda54519b4be860b4b3d33796f82f4ac6031fbd707

  • SSDEEP

    24576:0yzk9MhGOpmmAp/I3TDBVaq/nSlqklDewnr6USqT3+y:DI9MIOprApA3Sq/nSsk4wnrF+

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1