Extracted

Extracted

• • Target

    b1f94abb1d50910ea0e23af2f1f2ac52191109c33ec6c214e20e5eeea964f8fa

  • Size

    753KB

  • MD5

    24a0be7100dcfeb3071e777d1a435f65

  • SHA1

    43f48e4b900f5bd3fb9ddbf35bf1cd57c6ec3443

  • SHA256

    b1f94abb1d50910ea0e23af2f1f2ac52191109c33ec6c214e20e5eeea964f8fa

  • SHA512

    bdb76db2b7cf1b5e9db0e267d0a1a65b90fb5b15003859de5ace58a0a16d77fcab0b61fe1ca0c185e6846afed4871e2b61919753a71fabaccd2b5ca4c9ea5e39

  • SSDEEP

    12288:7Mr+y90SbLYM7ZM27ABEyRVHdzoujWqTFoe3dbVZVgT2xrhS7F+N1K1ID8ib+3Z:hy9H7ZABXfjhaetHVycUQVDO3Z

  Score

  10^/10

  redlinemaxirockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1