Extracted

Extracted

Extracted

• • Target

    14cb38df6ddfd41d988cb564ea582b63ce71ccf6c4155e29f00f71e83b9dc7df

  • Size

    728KB

  • MD5

    20a7af7a0710e5e447386e80093ec58d

  • SHA1

    0ce530bab2fe6765915dabb37b08a69b0501998f

  • SHA256

    14cb38df6ddfd41d988cb564ea582b63ce71ccf6c4155e29f00f71e83b9dc7df

  • SHA512

    8e39c591d596222cda38370125e043e8c4d70ab42d3f6dd23054f0378c0846a2cfed65ec68e7c66fa902340da4618a89c4739d7a40e9aa45916c4234a9ab5c98

  • SSDEEP

    12288:RMrgy905BEZh/zFx1yotxnJAN2JuqpNAWza/t2odAi2j5Xlogc5bQbk13xV:FyyEZhr1yMmN2JuqpNA+nj51o15bQbuD

  Score

  10^/10

  redlinedizamaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1