Extracted

Extracted

• • Target

    1d80425b19fc59f1f4ce3a82d7cd89fe007a67a2a1b75e8f733851bb79038680

  • Size

    786KB

  • MD5

    8d1ebd4678f86dd2f2afe94f69f37d60

  • SHA1

    58f5b02601aec3168a67967d08c54cee54a33128

  • SHA256

    1d80425b19fc59f1f4ce3a82d7cd89fe007a67a2a1b75e8f733851bb79038680

  • SHA512

    cb82abeb1a0fa1f5affec032b5e0616fc4e0a926e7b76f9307cb754a350b260ad2ba3f55cc3851fc138c575337be73728be195c3f02fa4f77d39adc0f4a9cce5

  • SSDEEP

    12288:0Mr+y90HASZDHxJ2qEbYv0X2i0eb73k7dhOruQg0yb/r5VuB9wqsSSxHeud4/lK:CypUHToYvHPeb73mdhOyQhyVVTsK

  Score

  10^/10

  redlinedarsgromdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1