Extracted

Extracted

• • Target

    03064099.exe

  • Size

    779KB

  • MD5

    8e972f881fa77a96d129edb5fdfbdec8

  • SHA1

    afd4eac2072ee8f039d021b489486fca7190d913

  • SHA256

    e9d123e074d810c33cf976cc45a8e314ed372f9bffafc7cb5871b2e9c4e2201f

  • SHA512

    93746978efc66cb36647f0b6f105440cb35f7d0741db3d8ae7a226fa4871c4a389d5d83da24583e3a8703ae653a8be96128074694f58ff31749e0f2ef0510db9

  • SSDEEP

    12288:eMr5y90s25kO7ALGO72n7VTpUXxFmyf3Xnh76wz+yYqjnlPzuEskoa9+LV:PyqQFiXCFmyfXh73+yYqR7uE0j

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2