Extracted

Extracted

• • Target

    57edd8b068de60b08dd72c4a6a338404bfe6dab4da2bc277c20ccce353ad2d50

  • Size

    753KB

  • MD5

    f63089e0b24fb108c4eddd185c7157b9

  • SHA1

    d0aa803039fc58b0fdf6ed18789c41afa035671d

  • SHA256

    57edd8b068de60b08dd72c4a6a338404bfe6dab4da2bc277c20ccce353ad2d50

  • SHA512

    37c76b1ccbeb74e9e6e180bbddbd428b7f67575557a992b1644dd611385e1a3dae3cb0c2b8b87668f384f92bebb7976d8efa5d06699eadd80586746b354025e5

  • SSDEEP

    12288:iMr4y907HhgZuWtx+FXaU0OgknSvgaHXLuH7dURVlRii1W9IGmk0hNM:WyyCZztx8KWZyHH7uHkEk6/i6

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1