Extracted

Extracted

• • Target

    451497ff5c678a6c97affbb5f049f06dce80749ee4f56d83696e872a98438320

  • Size

    752KB

  • MD5

    b55d0723497bfb8b51d3defbca854ecb

  • SHA1

    0a5766d8d488ba70d94e767a4313534106fb8de5

  • SHA256

    451497ff5c678a6c97affbb5f049f06dce80749ee4f56d83696e872a98438320

  • SHA512

    e3b07a0fe5d962f6b794282cc250e5a8957d63359ed4aae4970ada8e42dbe3e320e7fdb92cf7b2bb8a727a3168aafdb6b28b937c1e06ac3c676402830e1cca4b

  • SSDEEP

    12288:FMr9y90+cg/pOz4hI3vzbbMsfryx/00EfyAVWFS0Sn441ok3bBCywXGxzOhR:sy7JONTU00EfjWpSn4Tk3bBbwX8OT

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1