Extracted

Extracted

• • Target

    fdc722389ccc638fa8bc3049a41359b5979e4dab54ae3e9dacad83d2fece4cb0

  • Size

    876KB

  • MD5

    c56b00ee4a962eff7ba3238fc859904a

  • SHA1

    975ef15777caa255287805fb16fc11f3bd350a07

  • SHA256

    fdc722389ccc638fa8bc3049a41359b5979e4dab54ae3e9dacad83d2fece4cb0

  • SHA512

    b31c73626d62072748ac7867e9ec80843f5f41f394486088712873d40050068369f52b09b8f8aeb451f0e090b1b3a00c1fc77dc6610b0591dac68d4f990892ff

  • SSDEEP

    12288:TMrMy90NMRE2AJ1Iz85M5DTmoqkJ0KTDHxOafbvZP1c:jygMNALIz85ii+THDbZm

  Score

  10^/10

  redlinedimasrozadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1