Extracted

Extracted

• • Target

    77b0f69639ff12443d1a47355a309561b2d655ac4bc32d38ff17712a194340b2

  • Size

    752KB

  • MD5

    8fd293a370e208f91c06b47c3fbbbc91

  • SHA1

    73447c924e2d9bb5f9165314cd0607538a4bb8a4

  • SHA256

    77b0f69639ff12443d1a47355a309561b2d655ac4bc32d38ff17712a194340b2

  • SHA512

    f25cf7ac334a34738af053572e61adf7d96c720be9fcf84e34684c9c0b564dbe9ac07d20101e857b9a080dd3d5d0cd7254db16275c54d3eb2442ab06b5905e48

  • SSDEEP

    12288:GMrsy90BmKe8KTHqNqSZTpJezhNPBhtGzAtST2qeOJMhHABq:OyktKzqNVZgbPB2/iqhJEHAc

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1