Extracted

Extracted

• • Target

    7384d4f70cb6cf6aab272246250650977d5e026411097a3e7a5cc3b9533358a8

  • Size

    778KB

  • MD5

    114337a92805ad95a53c024ff594e96d

  • SHA1

    42e9dd0a67f492a68a9de2194df00919c05d1f0e

  • SHA256

    7384d4f70cb6cf6aab272246250650977d5e026411097a3e7a5cc3b9533358a8

  • SHA512

    0737825829b3edb12ebd0544f8558cd6d52e0034b0f234caf603c4cb5e7d0c733af73f50f9544fe35f4d1511c037045388d71ce232d6b8bfafa7fb07f84f86bb

  • SSDEEP

    12288:SMrIy9014ymhig52s8SklQkArXqO1ObJbUpkelUxdWDqA56twnhV:Wyrz55MQkQnObl0kSUxdWf5ZhV

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1