Extracted

Extracted

• • Target

    dc6005a225949af9e6c8b9c7f7ccca72b8a23bacb5c58fe54db8307138714052

  • Size

    729KB

  • MD5

    58050a1ebf8c3e4b23f3761673cd91af

  • SHA1

    7939756aeb4aba6321df0f41dafa06695b6838d9

  • SHA256

    dc6005a225949af9e6c8b9c7f7ccca72b8a23bacb5c58fe54db8307138714052

  • SHA512

    bd278b076baa4b264fe6fe5e9bd9ec88886562be0b46b7fb23a3b6d1ee41af37c9453ffe4ce1cada1eebbf25ab6578209e089a77c5573c1d2cc01fd25cd9ef25

  • SSDEEP

    12288:nMr4y90L27behJsC4Vd3XSa1GDem0khcOdJ0Q03cSQZ/w1spkngKVO3zvAI:nyzne4C4Vdp4R30Q0TQZ/asuV6zvAI

  Score

  10^/10

  redlinemusatindadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1