Extracted

Extracted

• • Target

    03784199.exe

  • Size

    779KB

  • MD5

    44876af9054c7945c5bdf8e25fc10fe0

  • SHA1

    819fd77ea0a7e8876ee4dba95719152344e78eeb

  • SHA256

    b9031245e7b3c5196efa32b9e63ef6efadd1744d346c70a68e233c1b3dc57c1b

  • SHA512

    9a3353dc19e10a7dc426a92ebff877b81b908d4db6f76b867b07ec92ee07d86db4378e3addde2001f9a737de9ad7de1a904a8c48bee20c819d826cd7257b32a4

  • SSDEEP

    24576:jyRv3iiBco05aT4fNs80KYl6LPGt34Q9MVm:2who0AT4fe3KLLPW34QG

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2