Extracted

• • Target

    4b8f41c7f37a1f677c1b29b7929cba30.exe

  • Size

    1.0MB

  • MD5

    4b8f41c7f37a1f677c1b29b7929cba30

  • SHA1

    fffa361041f01089760c3fc308270b5bba7fd95b

  • SHA256

    5d6a14a28b8b66b4dbaf0a14adb13ceeffe4055198919469c35b49ab6212c177

  • SHA512

    b12ccf7f8887b3d2be1ca5df66a569aeb4013a23c682721f92d2f0c785c8dd66b61186f853e09903c83d4ab969241eeb4b112f3767f1e9e6a26fe56facd855dc

  • SSDEEP

    24576:VyHetbh5zh15I+YqP5MkKntDjdcgQQu3HUxdn60:wHMbh5b5KqP5jKnLU3g6

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2