Extracted

Extracted

• • Target

    d433633c6f91fcc3d493ba6d5c617ae3767466975e22e7bbfc2a540af4925a5c

  • Size

    680KB

  • MD5

    4613ef5932483385c30c507bd7e11590

  • SHA1

    e42959248b125279d0417866b27c198fea3acb7d

  • SHA256

    d433633c6f91fcc3d493ba6d5c617ae3767466975e22e7bbfc2a540af4925a5c

  • SHA512

    e376019a19e02583bec7362eead1ee9516e2a84f67f1c63e5f9e7687f3e81fb74a29bb72e4230f2f9ad81f28277d4adef783dc9786be6fbe58ff7efe29a81747

  • SSDEEP

    12288:KoUOjvz/h0pY8lV5QW46uUcVwYPo02poleDehT+CWK9BetbtPFNicKX:xva+8VQtVQ02polYq+CH6tXi/X

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1