Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    751KB

  • MD5

    a594e05f13c6cc8b4e31c16facb2c0ce

  • SHA1

    da50b3b8c3463f5fad4bc0922a58e0cd628fdc3f

  • SHA256

    ee6678289afba6f7944db28ec1b1790cd60166067a5fe302e65900ef73a34749

  • SHA512

    c461a8019088e6a35d4afd8e90548e5794b4c0bb494ad07cafa17ece360609b76654f81e48801d2d44954d5f73fc9b513a4492406a1b5def7658de504e26a3bf

  • SSDEEP

    12288:yMr9y909Ar6E2wBoaBBeXP+1qmtbGumSJj3goi9dGJHYYZtsJLB+U3K0fTk4TeyG:byuArX2wTBBeXPnmtxmSdi9YJHYMs13s

  Score

  10^/10

  redlinedizamaxirockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2