Extracted

Extracted

• • Target

    38750e25b75c15c69db55340f943875d1c50fa8de5b2b298681abb96f89f2659

  • Size

    778KB

  • MD5

    e423bbc409d17eb1bb900f5ddcef3d80

  • SHA1

    5f5b6bca6025278e0bf36591bcb547abd324b344

  • SHA256

    38750e25b75c15c69db55340f943875d1c50fa8de5b2b298681abb96f89f2659

  • SHA512

    875a2b1b54ec6b24f704bef707189768833eb431f6a57df91364a9c2eb36d1e547526d8bac6a3b0f676db423a5463964f4891b576105da2961730ac5733bebb7

  • SSDEEP

    12288:8Mrmy90iB6GdU0DhSwzvDM4icq3FSqGw7m5N17X3lmVM0o3g/xKDaA9AqVrF+:iyv1NSwAJF3Gw8NlFN0o3JH9H8

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1