Extracted

Extracted

• • Target

    a296949eaa143bf40a4f565a155fc89c6980007eadc1e4abcb6597bef4a54822

  • Size

    754KB

  • MD5

    afd1e5e4d1636c2e3d3f0dbe8bc78786

  • SHA1

    04099697fd25e19cd7a44029e16fa06be971f8cf

  • SHA256

    a296949eaa143bf40a4f565a155fc89c6980007eadc1e4abcb6597bef4a54822

  • SHA512

    c747180cf5c1bc9b0d4d59bed102d9ea0fa068b5b67acb284c743d8e843e8e3f327b60f0e7cbb32fdeff966046abd9e4619e49c6c0d6010f88934d7d5e97906e

  • SSDEEP

    12288:1MrGy90oxLfVjk527bKcCIKYz1zyGCqI2EN98tR6Jd/6kcj7RuJLjOA6y4N7P5CT:XyhBjkEnK6KYFDKZ9JJt6kcj7AJ+AcN8

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1