Extracted

Extracted

• • Target

    28461c1edfbb6bea8a70ea7459d63f23a9cf036c78d927e5ebec597104acb840

  • Size

    779KB

  • MD5

    68574d0425aec53c7c8653f9dd0df82d

  • SHA1

    5fad0062fb4bf2ff4dd3db54097d04eb65e00b2d

  • SHA256

    28461c1edfbb6bea8a70ea7459d63f23a9cf036c78d927e5ebec597104acb840

  • SHA512

    3df1d5857d6d452f2a272e919f67dae2c5ab72e174171424d5e856683345801ba2ee2ff4f6c6ee80943eb63d987a75f0ac969f3ea595f71fbc0e654e082da80b

  • SSDEEP

    12288:eMrqy908vdoyztuR4ML/Y5pAMi5tOArS38g2w3cUIrft6a56QFeiq:YypVoyo4ML/spAPzW38g2wRIrVZ6nd

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1