Extracted

• • Target

    ae0a2aae897c68130237e73f58ab75386ff97f9ddb5d8ddf78e27c7fb1a7a4e2.exe

  • Size

    1.0MB

  • MD5

    d14c235d198e12d1c0059ac99858109d

  • SHA1

    7733d92c6ccc105134ac5b6ea4158682a4be8c30

  • SHA256

    ae0a2aae897c68130237e73f58ab75386ff97f9ddb5d8ddf78e27c7fb1a7a4e2

  • SHA512

    dfc5cea78dbc8f9cb979b61d77a810a8615cbbf6f1fe64147dbb935d31370258593e09eddeb83b2acbf9c3621358e13706f7684dae55937a409d4972b06db095

  • SSDEEP

    24576:Vy6T4N2MefcJuxD63pcm42E7mNVe5sq2rWvUdhTud9yumxto:w60TefcJKOnHjuchTudUt

  Score

  10^/10

  redlinederendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2