Extracted

Extracted

• • Target

    243f600871952baf0696ebfd6b4dcd1ae37addb066a778675364d5c439fab71c

  • Size

    778KB

  • MD5

    e9c92e73569c3b83a0523e25a5761250

  • SHA1

    b2771d441a02bdd832f7e3a28d6ddaa858b73321

  • SHA256

    243f600871952baf0696ebfd6b4dcd1ae37addb066a778675364d5c439fab71c

  • SHA512

    eaeaff3b81c7b1242c88f1a5e88438cae097a68789f697f2ca73ff7d51af7c9dc067265e237e39c3d6691da4acc3dd6fb8bbb6e0ff30817e3c6ae874b9e4e014

  • SSDEEP

    12288:4MrVy907oG0djyK65ekCTSxbH0jJl82imDaSTCuMZX4AS8St1D5DeAZ6LvYrz:9yp1jiekMobHo8HmDPT4S8St1D5jZ9

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1