Extracted

Extracted

• • Target

    3c7c842eeaf0fc00c5684502e6210910fa4f6c2330d4995db24d7d8cb2e382fc.exe

  • Size

    770KB

  • MD5

    3da73363f96ecf4b6eb8c6391686cae2

  • SHA1

    3b93459e2ebe3612aa8024e3a1c64863c2ca9a1c

  • SHA256

    3c7c842eeaf0fc00c5684502e6210910fa4f6c2330d4995db24d7d8cb2e382fc

  • SHA512

    e053ae4b9290524197be692531e910d25a19448fa43823a3a76ad5a15896eb910079bb48d0c58f85ae08dd8ea4be375e2dba456c4c77c816c637ee55a9995942

  • SSDEEP

    12288:lMrDy90H0fk2Ju7beeIIV2+CYRHt/q46R68r+fQW1Cmv4FKZw8iJU7X17:Ky5FY6eaYf/qf68SIWImgAZeKz17

  Score

  10^/10

  redlineduraheroydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1