Extracted

• • Target
    360022871.exe
  • Size 764KB
  • SHA256 6d8d665ed1c840de96732ee893e4fce02f684b81491b92291fb99d537cd2b933
  • MD5 98248407ec5008ee583911d17bb4a917
  • SHA1 84e4b926dee4e08234b516c3ed0cdc137a5fbf5a
  • SHA512 c95bc337d3ae0d7279f0e5d8c63be8fa0b83bfed7416cdb012102f4eb133b40a9e6bf5fc886c6ab72b291af77f8f9027cd4df4edbd8ce4093a831f82354ad796
  • SSDEEP 12288:nNlub1cmKxZH6DDpT/SEl9SoKLvuUbsq8zgRQ2t2IyN9NG5YVS1IGFj6J/mUF9aQ:nNgb166Hp7naxbb6gRQq5oGYIINmO87E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinepurelogdiscoveryexecutioninfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1