Extracted

Extracted

Extracted

• • Target

    0bc361a33a166869fa6ebc8d00533a25da509e9fb088673186748b591fd1d3a5

  • Size

    735KB

  • MD5

    5612e84052cc223c11011450c5702559

  • SHA1

    9fff2e6fb3d3db1624284ebafff102bf6fb04d3c

  • SHA256

    0bc361a33a166869fa6ebc8d00533a25da509e9fb088673186748b591fd1d3a5

  • SHA512

    818c8ef462d6c498fa010ce7ef22b7af3fcdcaa9b9da453c07d878b72365ad0cd03dd7643c2e0948c1ce87bdb122495cef43eb63746d4ef751c927b3ea922eee

  • SSDEEP

    12288:nMrjy90v4e8FIiA4Rg1oL2tFp2or1RfIGl/deYUAKocxNSvk+YbXQ0pCqBKqt:IyQruXJm3Go5RfIi/QJAKCyPpC+K0

  Score

  10^/10

  redlinedizamaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1