Extracted

Extracted

• • Target

    af0272982e1d32bea40edd4bb29f74761b72211e022b4df7c7f3da41c20012b5

  • Size

    592KB

  • MD5

    bd2849051e6490b1fc251db211839b83

  • SHA1

    14d1642273874b6121c2b2eb2d7cf87fcd211a88

  • SHA256

    af0272982e1d32bea40edd4bb29f74761b72211e022b4df7c7f3da41c20012b5

  • SHA512

    fc5159644ca27e95b10da729b44f0a9f4f565f92c021bb71d75b217268fdca32a04796de4273c15861c1a409a02949535ede5e9c92fd29b6dd8131e99fd06be0

  • SSDEEP

    12288:uMrzy90eMpvm6KMzMoJUJ44sFE45kyZZzeL:lywpvMBgZzeL

  Score

  10^/10

  redlinedizasherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1