Extracted

Extracted

• • Target

    5b4a4a9cd9143cff6919035b25fb90aa1f077d7ebc10e89272ea172bb8fcdb68

  • Size

    761KB

  • MD5

    9a450c5a1668623a79caac0001be909f

  • SHA1

    8145f3dc14855223f5ed5df87d46a2b796e5aa80

  • SHA256

    5b4a4a9cd9143cff6919035b25fb90aa1f077d7ebc10e89272ea172bb8fcdb68

  • SHA512

    3769560ca032cbb3011cf7ffc964759a76fdddd8a3802d6143012e82c051b9c40112642e970cd7ab6173cfdbe377e793db2b43ffb47651778bc605d4671a6184

  • SSDEEP

    12288:cMrqy90uuCno4IGfek1q9fOXYX6PpzGaTX8uhgl1l8FFRGGU+5XIaGtARYvBGblc:2ynK4DR1q9ftMpzG8nylT8GGUSIadYvH

  Score

  10^/10

  redlinecrypt1dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1