Extracted

Extracted

• • Target

    aaf8e7c5d464778159e768ccf8fcb8bc44ef84f6c4575f3ca962078037eaabef

  • Size

    751KB

  • MD5

    f8bc9e93fac2bf2e25bf54b54dd3574e

  • SHA1

    306eff78634f5126bfb95cf12e0c014c2d84b297

  • SHA256

    aaf8e7c5d464778159e768ccf8fcb8bc44ef84f6c4575f3ca962078037eaabef

  • SHA512

    14186ea643ae9115a234a90449805957de8073469d729e0bbd9aada2d7f9624cc20b0915a2b6a30bc4f9a18e6caddfa2d046a024eecd372d1820ceb874e26898

  • SSDEEP

    12288:wMr5y90ZRPTWjl3hl9GtRXx3aOmrxY0oDDk1AbpNNMg/3XxW9B+JDu/zRO:ZyyRPml3YbzrDk10Og/3E9kK1O

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1