Extracted

Extracted

• • Target

    e20757a6d327dcc4bf152f62acc4eac6804d5682afbe9f2a94a3c095bfd30af5.bin.exe

  • Size

    884KB

  • MD5

    2d2123290508540bcdd217e62cdbc4b0

  • SHA1

    5cc9377910752ad55f4086497dc8a20556e82512

  • SHA256

    e20757a6d327dcc4bf152f62acc4eac6804d5682afbe9f2a94a3c095bfd30af5

  • SHA512

    9cc3a5428117a9f4a13c4ea76b6583f30ca7ce35cd0c80065e63bff273a1378603c53b28b4ded7d4e129c96f720dd64ac207652852b0f8237c0a2303eb1ab812

  • SSDEEP

    24576:9yRcUS3KmIDHIlahSMB64M60lpOzHTj9Ps:YXS3KDDHmFDB6HzvN

  Score

  10^/10

  redlinedebrogogendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2