Extracted

Extracted

• • Target

    829b8266f1b2577ed29f7c5ae830a07ee7fc448908f672559066874d54d60049

  • Size

    755KB

  • MD5

    880eb7750d0bc6826bdcd2b575bd4077

  • SHA1

    c83f41c10b300e90553302eadcd3ba19884a61a4

  • SHA256

    829b8266f1b2577ed29f7c5ae830a07ee7fc448908f672559066874d54d60049

  • SHA512

    1b73050528f94937f4631092841081ef8ddd7b12f25bb46b141d164ca0d28c7b9a4406e92f29b907d7e848d23e62449df2da97174060e2857bce0b3e0c498303

  • SSDEEP

    12288:3Mrky90o79NtIgN9745duR5PKYBv1k/L75V5ikSfoZdxL2uqLFkSXBmRhSnxhkRQ:bylS5dbYBoLNVc2d92uq+OBwfRtlAf

  Score

  10^/10

  redlinegrommarsdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1