Extracted

• • Target

    274.exe

  • Size

    1.0MB

  • MD5

    d468b4d2bd479ee1a0f0b75de5b6558d

  • SHA1

    cf979eaeb63871dcba6062c3f6747bd726a310bd

  • SHA256

    26e933bc884b69663558667587bf7ba6ba47344d2dbde190b60419681eee8ee0

  • SHA512

    94047ca75c4a29968ae1151917a1a7ecea7afa95beab9e37b264b6c30d2fb48a4aeed2d77a50b9c3e04ecb344dba4fc35b13e8837db96d5281eddce42d281061

  • SSDEEP

    24576:Wyo5KMrv6vRzYm1LMcl5krusBY2bl4Gz68G7ORIiUmg:lsuF1Q+5kruspbY8sORX

  Score

  10^/10

  redlinederendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2