Extracted

• • Target

    08431499.exe

  • Size

    778KB

  • MD5

    9c79d66839648790644b9fd1120aa08d

  • SHA1

    0ff6a6076233097a4ce2a9c49f39d11f540becc1

  • SHA256

    a12dd546e54d84d55eddaa14e045718f345bec3edf54cc55a78ae9fe26d26cb8

  • SHA512

    01fb349021b6a0a1da3c200e00f7ad64ef4989ff3638cfca5f70c0073519d718a8461096aa87a8fc2a62db90c3f7e6c48bd3fb2f868b073f779f6d012a58e8f7

  • SSDEEP

    12288:/Mrey90e7fJgds3Cf4Q/Xwhr/uZFY3k9RAbP+C+R3llDXAuAxRFk:Fy7TJrSAQvy/ubYwRs+hpllsuh

  Score

  10^/10

  redlinedusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2