Extracted

Extracted

• • Target

    fe9ced64f0cdefb4c37f80b9f2381f469a40441c0226e38ce730d1216e83b946

  • Size

    788KB

  • MD5

    facddee37780791d39a853009397d5ff

  • SHA1

    fcad45ace33d97890cab01012a5c4322ed525447

  • SHA256

    fe9ced64f0cdefb4c37f80b9f2381f469a40441c0226e38ce730d1216e83b946

  • SHA512

    eeb61cf9fc06bea67972f1f7fbeb7a585762cb2477e0fef46e8de3eeada3aa0cefd8f1050eedc59541b7a8ebbd075f642af4e6187aa13ed44f23b60fe11a28f0

  • SSDEEP

    12288:kMr2y90eV1F/V67T1toLR0Ko0eK4GhKx03c2sPX2uGxRncE/8:Ky/V1FmTMLR5w03ovUM

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1