Extracted

Extracted

• • Target

    0d914597bc92eaf81fbc3641005c6e1b485ce55dac14433907b5f2e5bd4d09e7

  • Size

    752KB

  • MD5

    596d9525aad51408090ba567f801c6c1

  • SHA1

    517ef198ff931373682dc6842aba4b7bd501e0a8

  • SHA256

    0d914597bc92eaf81fbc3641005c6e1b485ce55dac14433907b5f2e5bd4d09e7

  • SHA512

    3cf3d3986b287830dfd7bf6176a80e3024065b12bec529a0ba9e5056ff89e86104ad2a51a683dcfec055077ca8cd1ac2dd5ec0a63b63e910f0feeb68c39dea5f

  • SSDEEP

    12288:EMrOy90tgTy/y6m57NIvoA061ltsiE7Tnpd5L8omQCqV24xgmSEJNM5JFn0:SyS66m5GAjpiEfpd5LXmQlRlNMN0

  Score

  10^/10

  redlinegrommarsdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1