Extracted

Extracted

• • Target

    6ff7fee0597444882087f31cdd6a7c14c1296cd893c838ee13c90f828ab26170

  • Size

    754KB

  • MD5

    d9e588ce0c1c0bb74e3048275b6d89f9

  • SHA1

    f2827b8d89701af9ba425ca1dfd29fa8b0e2c396

  • SHA256

    6ff7fee0597444882087f31cdd6a7c14c1296cd893c838ee13c90f828ab26170

  • SHA512

    6c377d02007493f23bcd66ceea4e511b067b3a5898b575333ad87b14a52b343ca7c46c75ca0f5fe972568efbf8f2fe85fb20dc59a738e4c26e778294e64fad28

  • SSDEEP

    12288:5Mruy90eac+otsH5QLRS9AM24+btqAs/67g9wUSwunWKiMcAH1OzvSFM0Ucr:TyUINS9v23Y/BwqunT4AtvUcr

  Score

  10^/10

  redlinemaxirockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1