Extracted

Extracted

• • Target

    02139799.exe

  • Size

    778KB

  • MD5

    0f6adab65efb1b4b7e3361b6d5415c4e

  • SHA1

    6dbc03f80e8e46f220ee03a86bea1bd3ea6ef5af

  • SHA256

    595dbaea0fe5ecf3efba5f23e318fa0ba52474a9a75a4c228533aea663aabf0a

  • SHA512

    78a3f2619189d798e2ee8ffda725a3183ac72eee26ce4d0e3a853b93fe6374ce376340b5d4e13da99d1509468596d884061d168f54ba1c77b138e934d1831c46

  • SSDEEP

    12288:WMrqy90imMwcscRdubvT/TxozKoIrGCeK3dzBOUnD6ATAwn+1NfZ:IyTmM48IbazmpM2/Tz+1H

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2