Extracted

• • Target

    5d20c911a61ca2afc8f3cba61d942e3d45a563626d87742e1b30c13519f61b33.exe

  • Size

    479KB

  • MD5

    d5b603d600d6d00ae38cab11c0700ef2

  • SHA1

    0227afab9718a9f07a267155296f7cb1265077d8

  • SHA256

    5d20c911a61ca2afc8f3cba61d942e3d45a563626d87742e1b30c13519f61b33

  • SHA512

    d05f4452a86c8fbd2a5f431c532366e2df0b3179c198c06537c7b795c8dab96943fe7a1a1efe16163998b10faa9bebbe039089a92013e2d748adb4957dbb21a7

  • SSDEEP

    12288:yMrGy90DceqXfV6pnGb5c1u317Toqf73raeg+v67cON:Ay/eefV2GFXZTjDeegbwON

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2