Extracted

• • Target

    e810e42176869e987b747411d29a8071fd18db65de336b5f9f29be6b85c3bb21.exe

  • Size

    479KB

  • MD5

    e405ad34c38d470ec9cbd1f2ac5e7251

  • SHA1

    874f32de82abecc138e1cc0870bdda57747e77de

  • SHA256

    e810e42176869e987b747411d29a8071fd18db65de336b5f9f29be6b85c3bb21

  • SHA512

    c623b8850a01202e489e9684fc57815c9eac558c9070753cd3bf3677d91b07c0034264573ab12bd97df2762da57677c5ae4c1270e90b23dd4ccae6b687014be5

  • SSDEEP

    12288:yMrAy90MPFI7/z6/ueVPROidjKyvpYNRZlCUVd5Lf:OyzPGTzdeP3d/pYH/3Lf

  Score

  10^/10

  redlinedomordiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2