Extracted

Extracted

• • Target

    d75bfc85da320bd1e6af59a072c14c5e5259c3cb0c8068d796c24625471b5d02

  • Size

    753KB

  • MD5

    85ff3f25857a143cc94a41662a9f6645

  • SHA1

    f5a725534ed6cdb0bb62dbc85eb10933c48f1ff4

  • SHA256

    d75bfc85da320bd1e6af59a072c14c5e5259c3cb0c8068d796c24625471b5d02

  • SHA512

    8c4cb373c1cde6aa978ca7629b10b9c1d8137e1bac96727f4cf5a286dcae3f6ad3bc65a156671f3ab234ee858f730c1f9bc5f300e23e91aa7b17c285084655d0

  • SSDEEP

    12288:JMr7y90y7B7xRW/PGHf97ztf7DmNEvgtTr6JAVre3t58/579:my5BymtzDmNOefEAde3ry5Z

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1