Extracted

Extracted

• • Target

    03819099.exe

  • Size

    752KB

  • MD5

    1b88c7a59cd521812a2e603ee889ed9a

  • SHA1

    4760e811851ecd74b8cfd8faa24059bd4162c4f7

  • SHA256

    9a0047cdea0db75a913fcb9d529ca782c53e5d0cbc106821e52923b4c5a6f861

  • SHA512

    53f31c45f32bdda2c9a6c3f0275a7c0ffb43468bfa712445d27e6659aa13f7e8293b77de25d2e7165d0c41e01bc5a847304c33312f2bd63cd0a638e84032099b

  • SSDEEP

    12288:iMrRy902c2TSQExEnC/eXc0sblJ3N6b2MAJajpyal2Up/rAP:Tyg5xECmXkbTNJJajp5p/u

  Score

  10^/10

  redlinedarsnitrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2