Extracted

Extracted

• • Target

    0316656fa20148efca98b309df5f062bc74812d05ec7a9e5551a0e2ff1367843

  • Size

    764KB

  • MD5

    62f997d146a908e0a53c35a9355d51e3

  • SHA1

    6bc750816408a1ad3db5757f105444262fb4d600

  • SHA256

    0316656fa20148efca98b309df5f062bc74812d05ec7a9e5551a0e2ff1367843

  • SHA512

    de51ff5dee7d1593e8bebfd5246b155c3cd4c0dee9c56ed31510fbb8ae7ca605360b641dffd08a4ce37c283a788ccb6cd8c41a06f562a6c550cedf994a01da26

  • SSDEEP

    12288:pMrwy90EH5kUnXm1u1+qjZ2+cG55NOmGQFrpMwc60s5J3jTd14w61mXahhD2WUY6:9yzHGUnXJ1FjU/GDNOkpMBuFt2+XZY6

  Score

  10^/10

  redlinecr2dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1