Extracted

Extracted

• • Target

    8d59e1888065057e604fb16758f2bf608b65cdf4164d925d7921117717602ca9.exe

  • Size

    785KB

  • MD5

    6876fb3d6bd73b84aade769a5c11e90f

  • SHA1

    a261ade928434437fb7ecb1ab6c93a6a603d81f9

  • SHA256

    8d59e1888065057e604fb16758f2bf608b65cdf4164d925d7921117717602ca9

  • SHA512

    37c7434b20849144c6557e1784a1d7b2f26c0094ab9fea9e201b6571a3d0ff64b26e1ac21c85e4cdb893b648e912406741ce7f52736adf47329d99d3ffaf83ef

  • SSDEEP

    12288:rMrwy90Dt4bdv4SseotN4alAig/onQhkRVilWkvdAestKR3GRv0DWDD7ihC29B:fym4bdBsxtNNrnQh+ViHdAPsGmDW8NB

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2