Extracted

• • Target

    updater337.exe

  • Size

    1.0MB

  • MD5

    965f38ebec77c8c5044ec4fd01d0af50

  • SHA1

    00cb64e372c476be3c2bfb4963d261c8d5c4a876

  • SHA256

    074b1edc5c4ffcb5ccb9938e8f04ec43faf654fd9400c06e0cc5731828f70530

  • SHA512

    d81a3ee4acc9c87b8b6f99df4f09379efdecaf095a3f82149298b2ef66b39c95d72730601bf5d9ad36088f0b01fcafe5600877a8976dba41c60e3c35897b9670

  • SSDEEP

    24576:Ayt0feH8AnASrvyqo5rbyejkY2OGu8RD89toZpGTwhFyZd:Has8AnXrvyqoJmeVGu8S9yZIchw

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2