Extracted

Extracted

• • Target

    file.exe

  • Size

    753KB

  • MD5

    ebd74afd0bb8eac5fa9f255de8b503b9

  • SHA1

    2dae539c5f75733ee2bc1977189c4846fa092bdb

  • SHA256

    b0174c919eb9653bfc80e8bf1480c3a3e314dd73d75d7ff68b186072162ac1b7

  • SHA512

    79c2103cb533389086d22c7045b871c4cb96003233e854bb8b91524d8c336abcaf75d351950ba5bb6e9030fb4d5bfb67808bdf681ba2c2864bc6c1cb97dfce06

  • SSDEEP

    12288:9Mroy90jgWu7eNWK7eQ/p9McIAAAUOyqdEImIW8w/ScMcYSIWjJYEzosIuJy4ozy:dyyu7eNWyFhycIHOyqSvIXw/eaIWjyut

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2