Extracted

Extracted

• • Target

    3f0fe1260453a9ed6f15e6b025a3555fd00ae2749e9f10645cd9a1c3127abfc2

  • Size

    731KB

  • MD5

    ac318715b1249ad451cf28cbb3f0291a

  • SHA1

    5c75a91f47fcb31882523f352fc0482ef87f9494

  • SHA256

    3f0fe1260453a9ed6f15e6b025a3555fd00ae2749e9f10645cd9a1c3127abfc2

  • SHA512

    962505e1b868ed6bfa891fa438a847a7a63117f30448e1c59a763a29868d14d8b02c55da0f4e67800ccf19e71475cfff8283acc290d446e906ce13f0d46aeccf

  • SSDEEP

    12288:7MrVy90WjGfJe5qezGvwHBorDPSVsFVZZAMfPp+OLhvFvHxynhM8g/VhJL8LVP:ayjjUJe5qRvwhorDPSVsX7PZvFvxEMhY

  Score

  10^/10

  redlinemarsnitrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1