Extracted

Extracted

• • Target

    dca017bb24cad293ec065f3e902c727fed38ee51394a16b2d1fe5a0f61c5ae3a

  • Size

    1.1MB

  • MD5

    b7616a8ae8c4da1a7f3f0049c4fe2bdb

  • SHA1

    53ea5506ec7c3292760d1597789bd9de9ff7c57e

  • SHA256

    dca017bb24cad293ec065f3e902c727fed38ee51394a16b2d1fe5a0f61c5ae3a

  • SHA512

    1f96b7b47068677f9ce1007f2b7547c7c77929b49d2974ac75a2856750fb83636b1f0a691b0a60a5e99eb461ada398bfcbc6f5ef212efaf0da0642eb4add07ad

  • SSDEEP

    24576:EycU6I0qCfcUr6ZjhFkMoS3xnt3Epp7sdr7jdalZap:Tr6I0qCf3r6ZjhFkMJnWW8a

  Score

  10^/10

  redlinejoanamastadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1