Extracted

Extracted

Extracted

• • Target
    25069c464f72f2bbddee5104f73e20d5.exe
  • Size 5.0MB
  • SHA256 2c5e97c51a0cd9e1de4085535595a9f90a2ba07974d0e2f17c8648cc3e7b1ad0
  • MD5 25069c464f72f2bbddee5104f73e20d5
  • SHA1 806718b4d638c302af8483db301ee36a1dc0fb13
  • SHA512 a13f631e3502f6bcdecd433789abe6a1aeafadb4a30cc3bbe4bf4c084ae8ca02d6cc2e16aaf56c85a979bd7246016db67e013aabe62e0e08118eb081e4174871
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlineevasioninfostealerpersistencespywaretrojanupx

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2