Extracted

Extracted

• • Target

    529d1c7ed27e630d73ddfa22b601b05f5f95549b54b6b10d3d27d242f3750d2c

  • Size

    806KB

  • MD5

    ad89b73413c69396fcb1e444346b5f40

  • SHA1

    70edeb46cd351568c53cb21eb30d65b4db7a7088

  • SHA256

    529d1c7ed27e630d73ddfa22b601b05f5f95549b54b6b10d3d27d242f3750d2c

  • SHA512

    19f05053cb129a4197a42e6caf734364e431a3d6ea9be9334f78bf057e8b89b9989929352f5f97aa88e01b9a5ef0c8980e12ca91a4bd4b0954e281ea1ab095f2

  • SSDEEP

    24576:Iy4N8fONakgIeEYfJdkPODeenr6USQcAJM:P4qmN5gfbALenr9cQ

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1