Extracted

Extracted

Extracted

• • Target

    a35d7021023d811fad337c9c42f49837.exe

  • Size

    740KB

  • MD5

    a35d7021023d811fad337c9c42f49837

  • SHA1

    e1d6a58dc61ea3edd658d5c0d49300b6739a04e4

  • SHA256

    e9d1df7bf986c1e6ea28266c075b19598edcd6c3d20e0d57968f27263d2edb3a

  • SHA512

    2a5f35e73ecd17fd37a52d61d2429fd7c4dc83f5a1175c83fedd7eb0be80822ffaec61631531a643dc9c7c5576efe4ef0e1ae93211f0eec5c25fd1777ce8db48

  • SSDEEP

    12288:5Mrgy90FPx6i7cF7EMtDhkG7d3EP4DbVd3+uR3T6lXoX5rv3QrcGA1IBQTj5R8nE:FysQi7PMtlkGR0gDJ134XoX5TAKIBQBd

  Score

  10^/10

  redlinecr10dubkarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2