Extracted

Extracted

• • Target

    22e25ff186839f310d3f4c76fb88c15c5a0626a3489195b524d6b9480e202882

  • Size

    850KB

  • MD5

    b9e012464ac82e02be4733e60204f38d

  • SHA1

    766ec6aa03dd6c151ae12779e59afa7a685d914c

  • SHA256

    22e25ff186839f310d3f4c76fb88c15c5a0626a3489195b524d6b9480e202882

  • SHA512

    0edbe2ce737e485e258c8fc61584bfa2518b1ba534f6d9ccbb02886340bf8cfed7e274f4f6f593209e73c9653d4ee349806310cacab46534f3a90f5d8a05d7c2

  • SSDEEP

    12288:PMrry90KKwsaHxpGbYwZ2LqY5LGOCS010nEYDGOBTDygyGmbwq3PjM+C4pRBY3Xw:0y3KzaR4bTwqyC71zYzLeJZMfW5

  Score

  10^/10

  redlinelupasherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1