Extracted

Extracted

• • Target

    9b105ecbfe575e26b3f654e2cdcc441728a13c835e39d634f7de6f6afdecfcd8

  • Size

    731KB

  • MD5

    4c38230baa524db4c7b08b7e030164ef

  • SHA1

    5870c6a4f55de7e816b6f459d81ef34ac6e98aac

  • SHA256

    9b105ecbfe575e26b3f654e2cdcc441728a13c835e39d634f7de6f6afdecfcd8

  • SHA512

    cfe8c59721856733ff8fd87bf5656a7595ce3c195df277e2f6e2e0b7c7f10ce54917b45f10c2d5c1a459cc68adc79dbb11a67acef68f19dab86accb776fa1c11

  • SSDEEP

    12288:FMrky90sRJaPib8JlHvrp9vHBHx577HA9Pn5FKNNaR+dJoFe4BnB5v4N:hy5RIiQLP7H97rAtaNYcd+Fegn34N

  Score

  10^/10

  redlinedusatindadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1