Extracted

Extracted

• • Target

    02a001d5bc502b5bbd300856292d10bcf7af08fd38e6b3e4035ed0c1451b2e6a

  • Size

    752KB

  • MD5

    4cbf98bfd91133b84a17cc90d3cbde1b

  • SHA1

    2768b46dbd13ba4f30f796e8fd1b326c4aeb3368

  • SHA256

    02a001d5bc502b5bbd300856292d10bcf7af08fd38e6b3e4035ed0c1451b2e6a

  • SHA512

    8b25264122b248632a3bb96fdb3df92be039b88ab0f6c6e8e88156fa56e9a1a6682e6d60bfbf845da218efe0ef33904dd1d20e1d21462d652684905cf7b0e9e4

  • SSDEEP

    12288:IMrvy90TfwPVa0nVmwUflfI1joJzHIlf9vRTBQnkegnHrD0DVibI+4PHU:ny8fq3EJzCf9PLegsDsUx0

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1