Extracted

Extracted

• • Target

    e3b9070a6bc6f8100b49c2f271e9bfe3600c745be337eba6633825ae9f84d218

  • Size

    779KB

  • MD5

    347b3fde5582f94b00dc3be8bbc5699c

  • SHA1

    c6b1dcc522ab726588803658eac96bdaa7295239

  • SHA256

    e3b9070a6bc6f8100b49c2f271e9bfe3600c745be337eba6633825ae9f84d218

  • SHA512

    dc81275ed8906ecb59de0c43a72192b92fc325c6644c19c3b5b6e78dbdd4b57437e2b65985fdb9aff6a9f5e0df97eb2a13cc472621ffe464b7f28b8f47f93ed8

  • SSDEEP

    12288:nMrjy906nvu5Jojsx1sVjPcHN8unTN35gcDmt7DHA5ebefQadB:QyDinsxUHN8YUT7U5/fhB

  Score

  10^/10

  redlinebrainmusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1