Extracted

Extracted

• • Target

    03444499.exe

  • Size

    764KB

  • MD5

    6ff8a33bc4c0403f96c766abb6c1b0a5

  • SHA1

    73be04394e09642e28a4f0a3aa530bf512c39ed2

  • SHA256

    1c6d03c32d32bc02c8cbdbf57cb427660b055f9a4b08f62f86eff4f518a3028f

  • SHA512

    a74121d068f66ffeac8e3713e17fa308a65e8914c55a0e2510074c91c31abd55f0f96111cbb482755ba494110ab3a93026b5368e3780b0b0cf9c011638dfd1c0

  • SSDEEP

    12288:6Mrpy90k1bCtI5vBPlqxUyOLfP168JW52kOXTAxKPCS7YeBI/kBp1nM6tIY+UEST:DyZ2IprqWyOJdiDOXU83Y8ikn1M63+tS

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2