Extracted

Extracted

• • Target

    6ec9b536aaf678020e62034b21f4d0544f1b7d8c48dcf304417a5179543c7338

  • Size

    754KB

  • MD5

    3738fecce2c5e8bc21fbff5441a98c9e

  • SHA1

    1b86c3c7daa8adc097bcebee0b3287a40b1c15e2

  • SHA256

    6ec9b536aaf678020e62034b21f4d0544f1b7d8c48dcf304417a5179543c7338

  • SHA512

    f6bc100ae53563d7ee7a73eab4478aadbadfda3e6ba15199bd04713ca6f86a1a70414e833b5b8a9a7c9ad2f18c3b22f9c2c82775ad144e97e8a756b21b051a6d

  • SSDEEP

    12288:oMroy90VN1jXyHvrlMVgMjWJhDDIOk9Y9B3Ep7mQAVIAkTEpbhv2Q:AyajCPBMyMjWHXIOk9kO46AkTChvn

  Score

  10^/10

  redlinedusaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1