Extracted

Extracted

• • Target

    bd3261071ffb8d7922c53337733228a1abac9746ccc2147cc713f9fe234c0d85

  • Size

    821KB

  • MD5

    9284733b6227f09652a10e836eda0744

  • SHA1

    8d72067381604ddb934d5809c04ff76a20009932

  • SHA256

    bd3261071ffb8d7922c53337733228a1abac9746ccc2147cc713f9fe234c0d85

  • SHA512

    a5124682cde46412994e3476af0c6889ae639d62c153a569597d6320b9a199675d9887cce20611f8081ef5ebadce712c4ac6345a5a1c41eab42a08ed57fe911d

  • SSDEEP

    12288:NMruy900xJmWiVLycOrggqq69zek680OBMuLUfZApYj9dP05e+GKfdaAIH7DTU:ryfm5VODV769zb6Sm9fWpexpfAB

  Score

  10^/10

  redlinecrypt1dubnadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1