Extracted

Extracted

• • Target

    cc2c98185fb0998f43bb3b2d4618e333b5251bf5fda6c940d00228e3728c72af

  • Size

    839KB

  • MD5

    bdab3d0a498b56ba4b24a66a6a9488cf

  • SHA1

    bfe0f4ee9383faba63635466906e1adb421bcafc

  • SHA256

    cc2c98185fb0998f43bb3b2d4618e333b5251bf5fda6c940d00228e3728c72af

  • SHA512

    e817cd3d1eb9677a749525d3d887a8a10f04a07c14553790e59bda193e9130c23cd5ca409a5157b2b75deafa70b64388b5c8bbe52fe98df357261ecdc963d889

  • SSDEEP

    12288:pMrfy90thBcVG7phBM7MdaxcTR3qd9TFn6jETC8P1oUrOB5KZOX1Ev2PR9X:Oy2h2VGbPqf14+ZP1zrsUOPX

  Score

  10^/10

  redlinecrypt1dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1