Extracted

• • Target
    7e27bd30e64157535afe9910078ec791.exe
  • Size 31KB
  • SHA256 e5e0601b8269cf5ffd12af1b005d913fd5d70235841daf3017a9cbb5da483dce
  • MD5 7e27bd30e64157535afe9910078ec791
  • SHA1 b5c9992735096b687c40fb846cf676d0ea36b537
  • SHA512 52043189a4817f1bbde2c84ca259da372b579c3d9ab17f133af4d6b965b88094fd93a4e832c833dce1f768f51e43401b3016aa9a72d8e1639b809a1f6d2dad09
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinevatos_admin4discoveryevasioninfostealerspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2