Extracted

Extracted

• • Target

    b0c8f64e4335a9f687e3b6a61429e08a6c50bf9162a18f385010cfcc8e1ad16c

  • Size

    785KB

  • MD5

    238d1f3f83210b9871daa9d45ffed762

  • SHA1

    b30e4b6af54d36e7ffb3ae43756182016785124e

  • SHA256

    b0c8f64e4335a9f687e3b6a61429e08a6c50bf9162a18f385010cfcc8e1ad16c

  • SHA512

    b1e965361cfbab5220c5384464fec1963d5ba02a76e1a152c81af43500dab777140212f037f7ffa42aed03a73f1b9af94d4a50058c759068b19a6a08c057c716

  • SSDEEP

    12288:MMrFy90fccZqD9AZptvipyXLggSqUscLYA6hNERaRDiSMKwRu0OWOD6ZZS:JyvcZorykf7stGCDitKwFOWbI

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1