Extracted

• • Target

    423979.exe

  • Size

    1.0MB

  • MD5

    9a64509d8384e008b823a47e118fabd9

  • SHA1

    e29d00ad68fbe1468991e7f67f4c44dc44f44a54

  • SHA256

    43e9c97290e39e90c51829a1d85b042c49b7f91b51e99c8a0417aa4fa0d196d7

  • SHA512

    b8566084992b1a48e141328737c3d452fc32fe9350174f69f4045d5917d530d215f042bbf0c143bd1a910d3ccd1497c477e2ccf33e05bc7a85b3484a9c1128d5

  • SSDEEP

    24576:yy3uJFfZGqzfwcexXwV+S/rLU5a/h76V0VmkzV:Z34fYqDwcfVTDweIgmk

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2