Extracted

Extracted

• • Target

    1ff0575c79e0920083174ae9ff94573e8699b6568fdefc5f09e5df57421aa679

  • Size

    764KB

  • MD5

    fcacd88941ef00df46978446589a1299

  • SHA1

    05fa1c737a60fc11c4d2b30918d5a6a030feaaf5

  • SHA256

    1ff0575c79e0920083174ae9ff94573e8699b6568fdefc5f09e5df57421aa679

  • SHA512

    fe721fb5bc36c185ec957165699bc38a281176020aa48ce01a5eb2fe6d730d94f796b4d4798f4460275b2d762fc7c609727b7a794a71e04819399d59ae3b720b

  • SSDEEP

    12288:bMrDy90m6ZbjCST9DJ8hIB0pP8iEfdVNuOpNFAXzPbL263cmhBANKCBYSEW:cy/ib5Vym8P8iEVD5PAjTaADA8CBrEW

  Score

  10^/10

  redlinecrypt1dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1