Extracted

Extracted

• • Target

    06417299.exe

  • Size

    793KB

  • MD5

    c536b23106b6751e25cecb883797eb15

  • SHA1

    e3cac7333abeee54d73fb5975ac38d1187658df9

  • SHA256

    fd5a54a7f59f3e6acc2d0c782a5e2837b03abd9595eb55e0f7741fdf7a7dffdf

  • SHA512

    6de816c4ff2cea26fd335797c831561cb504baac3bc41017021c956748705451afa7b7fe43bd941d1d5371e58c1cf8cdb5e0d26cd8712dee1268a29cac476782

  • SSDEEP

    24576:CyiOqyRIbDFbePJ+v7n+rsHUBRaWFeh++:pxIHFpiwHUBDFeh

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2