Extracted

Extracted

• • Target

    083a7552b08bfd899e53553394c71644dc8507be764218e1c04d3e2b33c16c4a

  • Size

    1.0MB

  • MD5

    26ef93144f27ba73b06b81916c5fa3c5

  • SHA1

    a4efd4373f5ce68570817c9a9c4b81274382be2a

  • SHA256

    083a7552b08bfd899e53553394c71644dc8507be764218e1c04d3e2b33c16c4a

  • SHA512

    5da3585d2549a7c8b2f67cc21c48128574cf443d9eb7689f7a05bc2924b6a026d43ae3dc23748d6c8f997c7bcbbd30fbc32ef008b90e3720a1d9e58057c82ba6

  • SSDEEP

    12288:yMr5y90ID88rSuxhk9h7O3pu2zgDHAuhicjBwSQinDh44r7UZjzX4r15R2X+3wfO:/yv88fI63pdgMubFciDhV7U6r1eXgB

  Score

  10^/10

  redlinebrainlusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1