Extracted

Extracted

• • Target

    69aa327a35c5be413b8e50b2cc2b5001894d10b72efce3d8196c0dd9fb8303bd

  • Size

    602KB

  • MD5

    12eed4b5273b3b5b56e6ffbb21a9adfc

  • SHA1

    75fba042987e8edcedb4e46252d256214a4e9409

  • SHA256

    69aa327a35c5be413b8e50b2cc2b5001894d10b72efce3d8196c0dd9fb8303bd

  • SHA512

    32ab5cbbaf0f54b9bf25ac87d92ba360b17c2d9e6e3873781fb80d7bfd02815a6dfe891e031d2e95d6c800e100428b38f0e4bd53346f4ebdaa308411ee453bf9

  • SSDEEP

    12288:1Mrpy90JHmWuo/hCXIQC0GJABRY+aoHutYNTtZc:0y4HmWuSk+7AeJYNTnc

  Score

  10^/10

  redlinedizasherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1