Extracted

Extracted

• • Target

    b96d28c0c43a8bc8c124dfbd69b03e2ea83c698024a7bd4e3770a2465e425c44

  • Size

    771KB

  • MD5

    51bdb8551f1e2c94496ed9930a9b61aa

  • SHA1

    3d99e2570bef52a6679c82b03822b60f874d1860

  • SHA256

    b96d28c0c43a8bc8c124dfbd69b03e2ea83c698024a7bd4e3770a2465e425c44

  • SHA512

    fb20b16dd96bf38e0ee02fdddc1211aed3a98f9d3e195b41bf2864a152e5daa08bf38add299d5df45a5b15a91dcd6cd10204cae4a901b457e8955dde4bb28a4d

  • SSDEEP

    12288:tMrDy905VLSJhCntGQ/xZxtHCjf/TkjpwUv9jrPqgv2amFks9yo9P92xsJ8D7XLp:6yeVfntGmtHYQlwG9X9vtMkAPMsI7F

  Score

  10^/10

  redlinemaxisherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1