Extracted

• • Target

    config.exe

  • Size

    1.0MB

  • MD5

    a296236b4cae082d5d35f0f725e42681

  • SHA1

    922ef0ea11ac7a7a4d22fee04207ff0793ab65f5

  • SHA256

    a5f3b7b70470ed75e8bdcc9f2db015f4de4784352e53d7259aaeb0cbfc25af1b

  • SHA512

    e79422fdf250165a4ab3adeb268ed58cd3ae33b20ea4debf4b8c24e21e2cf21f322934e8373cf85f48254a9a3f6fc19a905fccb52da9e3c90f60458ef23b0532

  • SSDEEP

    24576:DyajQcJVGdY9PxNkjbu107S8yfTmzVQhLhu22ejPZlWy:WajQc7nNkjbg07S8yrmzYjPZ

  Score

  10^/10

  redlinemuserdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2