Extracted

Extracted

Extracted

• • Target

    aa0a0547301027bfc54956857717b9a33941740e13916b65af2a3899e31af82f

  • Size

    765KB

  • MD5

    27a5eb4fcddee1037bfea29cfc11ca4a

  • SHA1

    ccf2097a2609384c91ee1383e9275edfba06dda2

  • SHA256

    aa0a0547301027bfc54956857717b9a33941740e13916b65af2a3899e31af82f

  • SHA512

    5e0576b281601924b4024b6d3ea2c2643d77dd2707592f81b6b0cb125585025a3b65e2d2a669553b204d5333d03aae0c0607cd725da277c4f3c27392a65c2952

  • SSDEEP

    12288:jMrwy900b7077CuF8BQ8+hSNhPpSIFUq3ZFdpIl5qbn1Bs7RRiNX:7yr7WhFqhhFUq3ZCroDsdUR

  Score

  10^/10

  redlinecrypt1dunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1