Extracted

Extracted

Extracted

• • Target

    e7911b5c06abaab7832d2a05e5e48635850aef6db5a07466199aa01b7091c157

  • Size

    839KB

  • MD5

    be45e72c8ac770c30d2f5916e762bbcf

  • SHA1

    0b54a5e65a05ec13a5f2926b1ead44f4d9d9fa64

  • SHA256

    e7911b5c06abaab7832d2a05e5e48635850aef6db5a07466199aa01b7091c157

  • SHA512

    72a94559e09f281e2ad90fd13cd3bc1fc3e76387672c00d8c3068834a4e575a56bef8a722c86dbe06d1933c9a73725bcd9f61ff619735a4e3e704531a946cbab

  • SSDEEP

    24576:myLw0gFEDf53NeOGORp0Zp211HDPYiD3N:1LXg6Dh3NhSmDDFD

  Score

  10^/10

  redlinecrypt1dunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1