Extracted

• • Target
    61e464bfa4f806a7805d2056171a8a7c.exe
  • Size 75KB
  • SHA256 035ffcab1903dbf2f58155dfb50c14f2463e01fe9cf46baa4cf678f7e6b255ff
  • MD5 61e464bfa4f806a7805d2056171a8a7c
  • SHA1 4f0d3ba083fc6da6afce3ea1345fcd7426b5a186
  • SHA512 e959d435d5045abe9c8095d5f962ff0a92169ebc5d64e4a7500b457a1344aa4b8f5a38d646729bbcef9fec3954346d35d478cefb805663d5919214abff38ac93
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryevasioninfostealerspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2