Extracted

Extracted

• • Target

    585081efbc29a699fd6fa2023072f2dafcfe8bdf14ab1b469d847705f2227fc5

  • Size

    780KB

  • MD5

    6a524d6e5da07613b45de896fcd4fc8c

  • SHA1

    a74886b85f4b5eb2bae86685f8bda3b5cebd01bd

  • SHA256

    585081efbc29a699fd6fa2023072f2dafcfe8bdf14ab1b469d847705f2227fc5

  • SHA512

    ec54fb900cf1d949b98aa4ecb55bf92d9ab08c9dcf10753b527f7817651966841880bcba7ed69f54ed09319ff0200e0a6ab5f23318c8001aba182884e2c2546a

  • SSDEEP

    12288:TMruy90Bg82nHjzhF24geetSWNtUpORQOS0ASUg0CzN9jj7YzPjeweA0tY:dymg8cHjzO7r/U0RQOS0FRj7YH8i

  Score

  10^/10

  redlinebrainmusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1