Extracted

Extracted

• • Target

    05848199.exe

  • Size

    790KB

  • MD5

    9284e8c26e77fb1b1544e10ca1a7a6df

  • SHA1

    4bff1222b22f4d921cc6570798c11878ba13f80e

  • SHA256

    d24ccf73aabca4192d33a07b4a238c8d40ac97a550c2e65b8074f03455a981ca

  • SHA512

    1f13ce678dfc7f2f9687127c71c132d9ced357aaa10de7efb2c1148a7f6fa81e3c82ef538f9aa3313a79162715db15742e804b463a036c7253efeb251b3ba41e

  • SSDEEP

    12288:HMrcy90JC1nUjY+h3gzq3HdpD9J+4l5ZqfYaIrDDlvtzL32lPX2uwHRYR:DycLcEWqX3D55eYa0flMv0I

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2