Extracted

Extracted

• • Target

    676d4be79719c9de2143f81556b286cf52ca24efed5f84caa91ce21eee8ef627

  • Size

    752KB

  • MD5

    cfecc694abf0a83bf79b50ae4ccdf8b0

  • SHA1

    e180e026443cbf19e5e6788c238f1fe41f1201cb

  • SHA256

    676d4be79719c9de2143f81556b286cf52ca24efed5f84caa91ce21eee8ef627

  • SHA512

    2d416ac7056cf0074ae39a8cbb0f4a50f10ab6a56e7bfb50a87aa8240ed3ad71d19f90fe641d87d37ef6fcb48a9eb55060b587c2b2210496a7728202c6f0b106

  • SSDEEP

    12288:/MrKy90n/YgTg1Aj3uhc+0fHDC3kq3YkxI/X0a8dbRblqf9x1X9GECh72uX0kQdj:hyuzgiruS+0vrFkxI/4RIVx1X94y

  Score

  10^/10

  redlinemarsrockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1