Extracted

Extracted

• • Target

    2c783e6f264ec5cfebd4712d45191d0e3cd4bd8d04d3bac4423a9b4a52f5e5f1

  • Size

    794KB

  • MD5

    034d6cc7f155553568e824bdbdb011b7

  • SHA1

    142cd9a5f7711ff30339167c3bb297a457b81ecb

  • SHA256

    2c783e6f264ec5cfebd4712d45191d0e3cd4bd8d04d3bac4423a9b4a52f5e5f1

  • SHA512

    37391fb444df9fb4913fe24627affd164466d341b19264856ae131b254600b2c9e0d0e849d730ef4d497599800259ff614b7be5c8f63816c0d0647c2618f9eb2

  • SSDEEP

    12288:UMr8y90vI4D6yWUK6ja7j2nmLj2992+L3mfZ7iQIP9ROVguFDQB08WYDfZ3QgK:IyZ0a5ja92u/P9rB08WyJq

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1