Extracted

Extracted

• • Target

    ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b

  • Size

    1.0MB

  • MD5

    671b210e48c8588715255cd0bc31b34d

  • SHA1

    1386bc6eca4197aca75814925f222c116ea1db09

  • SHA256

    ef2a05a43128f02243b62c9fcc18413d639e205660bdb79343d18f4e3a407b6b

  • SHA512

    99864562c5d173c017be9bc69455a2e88c482a5e332c0342ecd297c4fa763fd2aebb3aa6b680353edcc0b96428b4c73ad4e187feb6f21e1c797fac410696631b

  • SSDEEP

    12288:zMrvy90u39IBalThxMbtFUuDMAuEWNVe662D4wyQPxbvGvlQAz6KfB7X9r75uf1T:cyFt5lTXZuee662DY0il/9BD7udc41

  Score

  10^/10

  redlinelizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1