Extracted

• • Target

    05427599.exe

  • Size

    728KB

  • MD5

    032f33f8d2fc873a2768470f3baef37e

  • SHA1

    a182237ba140d29fe9809f98d92529addbce6eeb

  • SHA256

    787dad1bbeb81bbdd632321c158541f842447e7c9b3acd0aba65c80e4ded9a89

  • SHA512

    bb1c653fae1c46b76850bd6e056c057771c8fc74702483bb2f438808e17b4e895f5558ddfa84157302024216f65ec007bdeeb839787071fb6049bb8c6d5037fa

  • SSDEEP

    12288:gMryy90mCQH31/9WKsyanitRKNBqjb7o4XgtxqOGW5lUqK51kS26z4K8vgdh7XDN:CyPB9+1izKascgt9Gr4K8vsVUGL

  Score

  10^/10

  redlinemaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2