Extracted

Extracted

• • Target

    9faf803a5798ff7911e717395d30f069e173d24e62c76ca23937e331d27f3d4f

  • Size

    763KB

  • MD5

    d600a2005110a273de398ddf10d19de7

  • SHA1

    481a72c31913d0e3ddbbcd211d0911df462066f5

  • SHA256

    9faf803a5798ff7911e717395d30f069e173d24e62c76ca23937e331d27f3d4f

  • SHA512

    81444d0c69c78cbc1705522e9b2d9b4db65f597935027345923d48199cb76881f9dceb9d378c5cba50d76e6da0449d100aabe927ac7d417e14e298c00fa7d797

  • SSDEEP

    12288:3Mr5y90nMGp52Cxi2BZQE3jMqiDI+8yXjFunNdGsw4LVCmE4m0jwrgXncnlp:2yYMGKgiKrMu+fjatLVCiVUrinGp

  Score

  10^/10

  redlinemaxisherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1