Extracted

Extracted

• • Target

    57897b2974ac48348245af1a56e89f68.exe

  • Size

    778KB

  • MD5

    57897b2974ac48348245af1a56e89f68

  • SHA1

    169795d1e34efdc7636fd9916b47ce256be5ac1a

  • SHA256

    dced09999f640c0a63a7a60fbefc685b5891c67336d7c88ca79cb74ad49068de

  • SHA512

    855ad12dfd23c4fb80e82e8a4668a715a0a4965c4257fa17a038b32dbfe9a8d591cb342aa5490f05c8ed271a2a2d75e90f18cfd65777c8dcd8f5adf455fd2b72

  • SSDEEP

    12288:2Mrcy90buriqyIn6i8qJlV3wdN5K+dOMAb9iGPf1hztD2AN6LJRfLMfNfV:OykuGq9bZgDAb9jf1hztDNwpMfv

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2