Extracted

Extracted

• • Target

    d3a9ff1dd4f912d978d66734141ac936.exe

  • Size

    592KB

  • MD5

    d3a9ff1dd4f912d978d66734141ac936

  • SHA1

    4b9d4885d628ccaf51eab17aa544f9f7cb9e1f93

  • SHA256

    79f55eabf76444b61614756bbf0bd79c8bfe27fe1984b6b61b960120e8534b76

  • SHA512

    2aeedfe0bd88d312de43e686bc663aa165b8687fae0adaceef8fa9761261a56746aa7d97d18e79655642be7a1190bf5b63398c58aa5d59a601a1e12845be4c5d

  • SSDEEP

    12288:SMrMy90+x1t/H3GnDo2J71KhUhoqWNJQVwb11LCl7v7qCE+/Ir4bAJ:2yzx1AnDfVSU+JQVLlI+QrVJ

  Score

  10^/10

  redlinedizasherondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2