Extracted

Extracted

Extracted

• • Target

    d6b66a0ef20a3ea2313ca754bcde7f45efd6f0973a5fbbe43f4b78fd33030c98

  • Size

    766KB

  • MD5

    9620935a01767336e1f97960462bd168

  • SHA1

    97d9930b7bd78a474603085efccad4ce48610d08

  • SHA256

    d6b66a0ef20a3ea2313ca754bcde7f45efd6f0973a5fbbe43f4b78fd33030c98

  • SHA512

    46a261985443faa3c95c16899b88e7c5970f2e35bf757bdc3e64e095bd8afe3834b6757cb4038d987548a0d7b08d44b797653e13eb5188fe2174c469c86b50dc

  • SSDEEP

    12288:XMr8y90RHMeBgUaAMlP5cZEN66fbADnYSmK0qutFM8IlQqby1HssSeOvQG2:nygM4gAMPMTYK0qutY67Fspews

  Score

  10^/10

  redlinecrypt1dunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1