Extracted

Extracted

• • Target

    cfe9c910ac012c47badea5b528be5ceb57ffac0d0b98f85450629e9a218c515c

  • Size

    752KB

  • MD5

    e371fdd54e5288eeae41fedfb499d37f

  • SHA1

    88e7319aac86c59be3f1d5886d2fb08796621b73

  • SHA256

    cfe9c910ac012c47badea5b528be5ceb57ffac0d0b98f85450629e9a218c515c

  • SHA512

    6073efdc7e5377b1ac3914666f807dbf12a04831523a32724fb932a23d96b8989cde624936084bc0cc5c61ca1d33e78eed56eeec27612f74aa1c1bf28b05c985

  • SSDEEP

    12288:cMrly90C+1+r1Z5P4HtZj71CsKvR+aMOz6C5cPejqVY1lgAIwfqFEdon2Tls4f1i:pya+KH7jRCR83Oz6C0VY1lrIwyFEG2TW

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1