Extracted

Extracted

• • Target

    0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f

  • Size

    770KB

  • MD5

    1e226692b2d5423e50a51bea02971818

  • SHA1

    6372899359638d4440876a6e6c5c2541401241bf

  • SHA256

    0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f

  • SHA512

    fbcc06dce71e538d17a13d9d6d41b80b3c1f8ee3d03f81c5f2f461283dcbd6bedca32a60bd4bc8c09be36021afc4c3531d1d2264129779988fe59599a040a90b

  • SSDEEP

    24576:LyiCSIPlQjAmLRNtLh0o/IhSdi6ZHB9Z:+hlkASDXy16ZB9

  Score

  10^/10

  redlinecr2dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1