Extracted

Extracted

• • Target

    908e2d8a67bca949c28ccd3e4d57c45c91d09dbd4bad4ec5db13e0a6a02789ba

  • Size

    757KB

  • MD5

    70845615dfc73acbc53bc52e16084c5a

  • SHA1

    a7eb8ef95fb5930355983e0b5c4abba5b3df461c

  • SHA256

    908e2d8a67bca949c28ccd3e4d57c45c91d09dbd4bad4ec5db13e0a6a02789ba

  • SHA512

    a56b2b1ca1433e9ce17c81ca97d0ad4a9b2fc43e2ea29ee8d84f12997fdf35d7c4581929d069400acffc473dc8500678ac0a3a3025106d3784d0caaa03f224c7

  • SSDEEP

    12288:kMrDy90VuGf0LzLL6iWzXY2mjjvEIX6IEfwMgkibEOLZPUCSoxK:3y8u7LsM2gvx1Efw99UCLA

  Score

  10^/10

  redlinedarsgromdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1