Extracted

Extracted

• • Target

    a7ae8e39b6e404ac7dd9f1ccc3b3ff40e7c676f8252c0a70b6176072f0dad7f5

  • Size

    751KB

  • MD5

    864910b77e3856ff2a4195dabd62685f

  • SHA1

    cc51fd5cbe8dc2d00a750547bbc63da8a4c9976a

  • SHA256

    a7ae8e39b6e404ac7dd9f1ccc3b3ff40e7c676f8252c0a70b6176072f0dad7f5

  • SHA512

    115abebcda3efaca48a35d3f9a3596b87d49ac77f97447b6c32eb71260f473300eade0ad33476fd574d36b8a162f45217bcaa1ac39bdda2fb22ef446ff6317f8

  • SSDEEP

    12288:dMr3y90jl7wh9ax7PVep0ERilrESqFHtk6YQTbbs6CrlVKEHzQx2uHf3y+VmHPld:ayglP9PVefcmJxtk6tbI6wlV9Qx2upVW

  Score

  10^/10

  redlinedusaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1