Extracted

Extracted

• • Target

    bf702c8134e929d884687212ad198f68.exe

  • Size

    551KB

  • MD5

    bf702c8134e929d884687212ad198f68

  • SHA1

    238212284dcb7d88105451b0e8c2a19fb7b74896

  • SHA256

    13eb015e11f81acae8a3308ae8b60bfaf20f686cbbf3340ceb301724c2d5a0da

  • SHA512

    498bfc3dae4feadc7ea068a61c58d85b9f2fda9d7c99e04b5a13062accc79d167a3361fe4add15c2d0a188505dcabea25dea75afd819028925aaa7105fac0806

  • SSDEEP

    12288:fMr9y90zXxxUF6LFKPLAaiRdD2Ec/VmrnWrpw6Kusq:6y4e6LkA5LNnWrpVKs

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2