Extracted

• • Target

    GitHub.Installer.zip

  • Size

    20.0MB

  • MD5

    14871c98f75a900ac3b41c9091b0484d

  • SHA1

    5849d6ab6cc59560a5857267953e98071bd3ae55

  • SHA256

    403d0422e6db9adbfc47a7056e3946737b7e76fe097c4c43d4906fe167a5e75a

  • SHA512

    7c3b8d3fac4357e03d68147dde1aebc0cd3253b31a592a5bb1fd94dd60b192d89961f9d4573e144e82d023b5945aafcee61955cea657d8aba959465610ade40e

  • SSDEEP

    393216:dXz7pLcn49wQSjauUux6BjNNXfGNHaBso4ZiYj6ZvfQ89HbZ+:dXY4GQSjaPLjNNXO621TUf79HbZ+

  Score

  10^/10

  redline@sentak88discoveryexecutioninfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1