Extracted

Extracted

• • Target

    01a1abacffc18e6f0798d57f2e024811daa24d5137eb27e84ac7ae90222e2318

  • Size

    771KB

  • MD5

    6164ad0bb84df816d4b7e5476a4e8258

  • SHA1

    b604062ee830e422e2f92715ff2d93a1e8fc9b5d

  • SHA256

    01a1abacffc18e6f0798d57f2e024811daa24d5137eb27e84ac7ae90222e2318

  • SHA512

    682e299e37400a868bdca12299dc8db194f733353f2bc03a3558499177713350b76566e79a1bf3f6f97c541a5507c1edff26c6459b260cebe0ddf5450765bcc2

  • SSDEEP

    12288:UMrHy90x9JGKJRGArxJNY8no3m/+yK8MyfciIrtK9vzLj/8/Hm265W3:ryA7xKArQ3dyZZc9rtIb8/mHW3

  Score

  10^/10

  redlinecrazymuhadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1