Extracted

Extracted

Extracted

• • Target

    a53d95ad10e6424ecc57b91e6bcd73f7.exe

  • Size

    760KB

  • MD5

    a53d95ad10e6424ecc57b91e6bcd73f7

  • SHA1

    d0efd476a4f78240bb829ed74aa3fd0e7afcd64f

  • SHA256

    612a40afbbc2d8ef6c3625a74b339ed2da36480433e099a0461aa1c5dd569028

  • SHA512

    af9e4650c470244834c9461d62a31bb0aeb6520186ef787493b155283fdeac1e59f7133abaf7da52e09be0db6afdc1271a57140c8c47dff807c121d262750aa4

  • SSDEEP

    12288:tMrty90v2AzIfELXj2PQpxMlfPErp6IqTvoTJejUnQlm35M6hUp85TDE20gHr4z/:syFAzYEWPFleYIqgJejfw5h75TY20gLM

  Score

  10^/10

  redlinedusamundermusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2