Extracted

Extracted

• • Target

    f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

  • Size

    766KB

  • MD5

    76fe6136f5779acde14ba95af0f40086

  • SHA1

    7a36fcc90193eb9b8a25ccc3b73cbc6c7bb26a57

  • SHA256

    f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

  • SHA512

    23bf9180aecd22f626ef952798615268b60cf2e47cec81b48ff0b919721628636a4e6e3e3bfc814be08d528215ac6985e4adcf24acab3ad77f369c0be491d9ba

  • SSDEEP

    12288:nMrJy90F0F/Vl8YL8lbm5ge9+v0zUWjWurLUN4acYipBV4hklVlZaAc/Bf+SnnAc:+yNBVl8++xe0vzWjWkQiFb6gTYAcZf+c

  Score

  10^/10

  redlinecrypt1dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1