Extracted

Extracted

• • Target

    96fe96ce3b2f22ef133ae448f62c1dfff6f8eb474108b31be9e50e188b48c2d6

  • Size

    600KB

  • MD5

    ee51d1c855c21e5434e0ec1b6959ca65

  • SHA1

    58eeb9f603a2af19959085d60c6ee6e66ebac399

  • SHA256

    96fe96ce3b2f22ef133ae448f62c1dfff6f8eb474108b31be9e50e188b48c2d6

  • SHA512

    eab4d62e3164166f20f5c605cbad7cba5c2b8b39353a8cd8ab9e9d494c28bda012250fdf98c941de2112ee33d1338a861b7a86c123534d403de00322c7ebe92f

  • SSDEEP

    12288:NMr1y90dvDLtGU8YxJ6HaDOpMt+3HjVmzGvL9CE1JAZ+A9v:UygrLtTW6DOqt+3Hw6CE1pA9v

  Score

  10^/10

  redlinecrazyduhadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1