Extracted

Extracted

Extracted

• • Target

    0deaabd1a71e70e6cf1252b8574962989b89f78afde03b90059c5e48cdc02ce9

  • Size

    839KB

  • MD5

    1936829aadeee86e0bc215d9151e14e5

  • SHA1

    317708e5fcc50ad527284314c94da9fdb48f2c99

  • SHA256

    0deaabd1a71e70e6cf1252b8574962989b89f78afde03b90059c5e48cdc02ce9

  • SHA512

    7d7e6508fb67169aaa2acc059e7511509ba58c7f29ce864b2b208035c05a5de7f1ec8868474adc7bf487448a1ad9dd2033dbd8632b07a62d4bb0fa4d803cede4

  • SSDEEP

    12288:SMrvy904IA83KF0Vw4nttlvoC7lrvDmxc8d/YRzGy02wTpsNgxohhA1xQVsQ9:pyRIj3KiZvlv37lL6c81YRE2sqQvss+

  Score

  10^/10

  redlinecrypt1dunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1