Extracted

Extracted

• • Target

    3a45b28da5d5ead60127233f241ff640641ef5c8c0f4a89dc1e5e5efe97afe35

  • Size

    752KB

  • MD5

    a9a1b3e6debf695d6c67dcbb005103c8

  • SHA1

    2276fa837e235c44df69f23877ac27f7b7583071

  • SHA256

    3a45b28da5d5ead60127233f241ff640641ef5c8c0f4a89dc1e5e5efe97afe35

  • SHA512

    5031328d50d7a16cf686895f658685eea7a0ad6ce6e1e7d6ebcb51caf0fbd624c5b68dfb1a478fe29c4669d41ee4ca662cd9138421b3342bbc91d659e739fa2f

  • SSDEEP

    12288:5Mr7y90/nUfGuuW36vcoLIExMnFimjPGUTZqfSkj1gvL7pAzqWqzvlEeiHt:OymN/xMnFVjP5YfDjsvpAO9Ed

  Score

  10^/10

  redlinemaxironindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1