Extracted

Extracted

• • Target

    03940199.exe

  • Size

    788KB

  • MD5

    9dfc45db6dfe7935f64ae556ee996eaf

  • SHA1

    7bda6a76735a0848b30e710188c67ab9cdd86f1d

  • SHA256

    b0565c75897fc1682746fae0831d37d6d81ebf8f1290b988fd74853902169d9f

  • SHA512

    ff9e1eb61df83831c7dbb9127adf700c57ed768a6680ccda74195b3f8df31875c2b368ccfa677aaf4616d7d1b5363347689a33a555df800b558d9ed8eb37c0db

  • SSDEEP

    12288:7Mrwy90PAoWwGvCkYWSFWW3rCijZGlI4QEnct31TnuLJetjCsc2sPX2uOxRcHgco:vyedWwfTWWtZYApovYcAcl2R

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2