Extracted

Extracted

• • Target

    c5fa4cf5b20fc39d9869730a0f99fade7bf982edd11205438e093890cd86a12c

  • Size

    752KB

  • MD5

    cffd3f1db0d0be9cd20dac99b1803c2a

  • SHA1

    7837a4b9caad4148ee3e4504f3e3ca1b9a65d639

  • SHA256

    c5fa4cf5b20fc39d9869730a0f99fade7bf982edd11205438e093890cd86a12c

  • SHA512

    fd253e80b05b43272f3d26eb275147100f9762921e85b2a6658f2dc8b6df3b50e115a753e833fecd47d1ad334dfa9684092cf74b0f3a46d70c25b54b0c514629

  • SSDEEP

    12288:6Mrby90+VPVSf67m+R0biw0Irl9o5nIvBe1Jofhgl1lMeklQINplG2rK3X+0:Ryxqf6dSB0yECvBe7+h63Me8XLOH+0

  Score

  10^/10

  redlinedusaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1