Extracted

Extracted

• • Target

    05857599.exe

  • Size

    778KB

  • MD5

    32e4e8877c8803b117e5a45b4f6aa9f7

  • SHA1

    645ae248e7ae0c8012edc2078671344b069046a0

  • SHA256

    251273b54f39b8ab120ffce464a3ea4ebb0b5a5dc3f246d3fb68c53de72e6d76

  • SHA512

    9e35a32a5e5f6085e28edddfaba2c27ed57d577cb36e356bf9fe158da7b74dd7501e194599d6c1953ed6cdb309d5a8e07d773e5d25fce27aef4b814fb540deef

  • SSDEEP

    12288:UMryy90LX2AhdsuR85GZPW4sOlIZtm0C8w9gdhHqgARGS9s7D5AneVOYdd5:GyeBHi0c4rim0C8w9gdh+pc2nXU

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2