Extracted

Extracted

• • Target

    6c0b6a876099cc2bf4a096e895d5849cb466b697629d067f83e9690e9b5705d2

  • Size

    729KB

  • MD5

    5dd444d8996f8c264d6871a4082920cd

  • SHA1

    25fd6e191c8fcc709f445dd4559629db38258107

  • SHA256

    6c0b6a876099cc2bf4a096e895d5849cb466b697629d067f83e9690e9b5705d2

  • SHA512

    8def05efec67edf792cd4aa71a9ef9576fd57dae7e1d49ee5b904399b7165e91c1f3e82492d5cd7a9a44f175a3dffdc82cc2a253c0b15f1e19eb1803a23f55ba

  • SSDEEP

    12288:DMr6y90r9ENSrNhcxb3qgC/uMOPG2tbdnW8SVHlFvH7/8C+/MwB07Ran:VyK9ImNhcxzV4uKUbJW8iHD/KLilan

  Score

  10^/10

  redlinemarsnitrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1