Extracted

Extracted

• • Target

    ff7c5b5f9a3778ebdf160dd4639add452751f0792c31125d20ab0155847f92ab

  • Size

    752KB

  • MD5

    597aea6a35f383b14828701eee460fba

  • SHA1

    40db7bba52d912ba661812765f343222aa66b16e

  • SHA256

    ff7c5b5f9a3778ebdf160dd4639add452751f0792c31125d20ab0155847f92ab

  • SHA512

    2ee609923f57c3f293cfb11c471db21a7cd1b3224a415fa48b4e0575648df97662b19037ba677fcc4f73db172ef0d5cb3fffba3a9448b1e565f4de4a13a51536

  • SSDEEP

    12288:ZMrSy90zqNW4XqqhG4gK+Ip/KhnNQvSGIJATF0DafpSPUlEJ1Q:Tydkf4gKv/un6KGQATF0UpSPU6m

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1