Extracted

Extracted

• • Target

    cfdd7507bb1c0c8e4eb780cd6f1132e55ecd89d9fdda2db1eac289e1fd18f0dd

  • Size

    752KB

  • MD5

    0b658fdc4dd51ce16d164dc69ca547f8

  • SHA1

    53671b8ffdb60f1456114b50791480114c50ffb3

  • SHA256

    cfdd7507bb1c0c8e4eb780cd6f1132e55ecd89d9fdda2db1eac289e1fd18f0dd

  • SHA512

    eadec2c27d340a73b90eea6760028c90bdb386796ddada6a2a8990f2730e067ab1ffcf975a0389fa4dea4e928197bb06bc2639f2ac102b8cfe893dc5d1d9f3d7

  • SSDEEP

    12288:iMryy90xSzQ6GiufvrgMxZ0oI5mxy8q3GY+cUheWP+g0uM7Mpy3cenVEExZUn:UymSzQ6GHfvrRcHGFdjVMQUxfZy

  Score

  10^/10

  redlinemusaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1