Extracted

Extracted

• • Target

    7d335995f778316302b5a9d4898f299bf2abfb786921d5567eeddcddf67b740c

  • Size

    787KB

  • MD5

    fd204078f01b440a2cc3efcedb064278

  • SHA1

    4c0135be45a9088b1e53e7e681a7dab223c3e2c8

  • SHA256

    7d335995f778316302b5a9d4898f299bf2abfb786921d5567eeddcddf67b740c

  • SHA512

    ced1119b7834ca5cdf485cc705c7441a481005101663a1b4b7fc123d5e8a733d45bce0b8f2085836d11ce7a65bcfd8c4b917beea6da4d1cbcd9ab72cbe657019

  • SSDEEP

    12288:KMr3y90aZN9cUka2kYZUyxO//GYu0J7ZYSgKoQiULb4I45r2t2caaEfRQgt:lyZZXcUka2PZ7xmDtJ1S7ULUtst2Jpv

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1