Extracted

• • Target
    191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.exe
  • Size 3.3MB
  • SHA256 191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c
  • MD5 dddc14c3a1bc942e3219b311b3c688fc
  • SHA1 017b79496bacd9cec9eaa8e4461611675f0f6e3f
  • SHA512 caa7b7dcabd43bfdb4d7d88102f3f6f9ceafe174aa7fa9003880fbfd4bb3c8d91ae64f305c25b2c57cfe30fd6d586419c1d68be7035b9851526cf14e5bce930a
  • SSDEEP 49152:1+MRdOHlNrOToziVHPPNLxeJLBZ9FMXX2Sa55NLuQdOibFJfZmgTxo+a7yO:1ryrziVtLSFZRSmaQdNJRTamO
  • TLSH
    T11FF5F113B2CBA03EE45D0B3B0572E17894FB6E556523AD168AE48C9FFF250601E3E647
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  loadeddiscoveryredlineinfostealerinstallerupxadwarepersistenceransomwarespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2