Extracted

Extracted

• • Target

    89d16ad6b2fdfe466e744945731fa48555ed02f3d29ff6590896fcb220a38e99

  • Size

    786KB

  • MD5

    a8352641971fc2b165442c6252e2497e

  • SHA1

    41e9a849aecbd749a667fe7dca25659e415f8d20

  • SHA256

    89d16ad6b2fdfe466e744945731fa48555ed02f3d29ff6590896fcb220a38e99

  • SHA512

    8baaef3cd9a3d24340114e1dca53de05b36a7bad93c73ab934b32ec0b495e1e6f7c235bf93ea1589372810542a5d8ccc7e2b81584e12193809ee6bab0aae90c5

  • SSDEEP

    12288:JMrHy901XaWTRwWkixwxiP6vv8HKE+BqVAEmtA5Vuqjwqs3xH8A4U:CymXaGk8wgP6KKE+YQtMVmco

  Score

  10^/10

  redlinegrommarsdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1