Extracted

Extracted

• • Target

    f880266813f9d9dae83b50bb9d25c38ec73528699d75f4595cd3897c8cf712d2

  • Size

    779KB

  • MD5

    0b10eac915654e8f6b87b7f9a0ace470

  • SHA1

    8f2975d9e4798c080f03a86aba865cd6dd792fee

  • SHA256

    f880266813f9d9dae83b50bb9d25c38ec73528699d75f4595cd3897c8cf712d2

  • SHA512

    ab6956529cace3f5359d03036ea5b1506dca4a1f92586be7d1288d032494e0e151f44defcf858cb742912a3fe1a13a3751947853e9076e19011d3e96c5c28566

  • SSDEEP

    12288:IMr7y90lpAOHybJE/XEZYVTPaoXzDYIeZ8jfItlj9CoH78XWwc9DXAokYsvNs6:DyW+Aybm/iYpiczLeZ8jfsiXTE0okq6

  Score

  10^/10

  redlinebrainmusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1