Extracted

• • Target
    4993c73a8fff1662e40cfdf11ce7c75b2f9b3bf34fe90fd5bcaef131ca00203b.exe
  • Size 1.0MB
  • SHA256 4993c73a8fff1662e40cfdf11ce7c75b2f9b3bf34fe90fd5bcaef131ca00203b
  • MD5 6898686657256a0d213e8d9bcba5450e
  • SHA1 ec821fff0bd53fd4341d4edf8b44089b103bd8ba
  • SHA512 0839c359aaf6a3600c0b5f70d26f71d4507f6d30b0c79fedf4f5b8a73a6b39999dc30827e76abbaac1abfdd47d7355936db9e0064e181198978b3c62eed79696
  • SSDEEP 24576:Yypq6QuaINMbKFaE+8L85g/LGPZMJynTUGls7e:f3Q7INM2Fad8Lz/KZlnTZlq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2