Extracted

Extracted

• • Target

    23b1389e0bc1950937eac0ef9d351c4d070dee12c4a9e01ca44a6f3184ce4811

  • Size

    660KB

  • MD5

    cf08b08ebb0393723b58889f050abd38

  • SHA1

    f907515d24da608ffe418b15483a5034af0d3383

  • SHA256

    23b1389e0bc1950937eac0ef9d351c4d070dee12c4a9e01ca44a6f3184ce4811

  • SHA512

    cbdb928e3ef94d1c916dfe14ab649cb64a1b6c2ade676c1b87ed9640c7be50e52d655dca098c159471de4160a5fa8ef5f2bf30abb3a17e4727a795edf80f63ad

  • SSDEEP

    12288:tMr4y90yRdkGa/U0CbCKjYW43lF+qf57+rUKc18qRBqZSIpm+fl6TW3ds6kE0Uti:5y/OpsjjYXVx+rwRDIplsTW3X/0Uti

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1