Extracted

Extracted

• • Target

    039388bd0331f8d21c32d27a9ae25de41ea1e40fa54eda6148221e418bedfedc

  • Size

    794KB

  • MD5

    1081f854bfa2159bed4eee259d17bd32

  • SHA1

    1d5cd118d396c487e77dc61ad8539668ba86d85a

  • SHA256

    039388bd0331f8d21c32d27a9ae25de41ea1e40fa54eda6148221e418bedfedc

  • SHA512

    d03668069a2d2d8f0919d4b43657d548cae31e1d619aa28a12c4af80c9ff70e18f4fc90ac9467aad3ee422f82193f8fe04fb40cfe54e20a73f77aa1fe923abe7

  • SSDEEP

    12288:hMriy90v5Zlltt8WW9q5/gD8Y2tASwxC/j7wIF4E9ZIejupf5RTD85VtGRNzeezn:ny0ti9HCyzA7w/+ZItRl85W7zeeoW1N

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1