Extracted

Extracted

• • Target

    8af7771ffbed6502c800180152edc7193576728f5b3753d1272ab5f68f274904

  • Size

    781KB

  • MD5

    67a9e2a8500fa097bb42348c28391a7f

  • SHA1

    9f3b60b5e716d856898606eb7ea9748159bbf87b

  • SHA256

    8af7771ffbed6502c800180152edc7193576728f5b3753d1272ab5f68f274904

  • SHA512

    7ea05791a7693b162983b7b416624ecbdf6878b759cbe053057e03ff865aeaa7d22a60815e4b78d694e56f286ac10b29644f73ec56550008e0924c9e49579258

  • SSDEEP

    24576:Cy2+Uq0fUQA4eRDEf3uNIUZ6fTHc/0wkt3lJHgelzt:p9Uq0MQA41fTU+8FklHhl

  Score

  10^/10

  redlinecrypt1dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1