Extracted

Extracted

• • Target

    34160bb03ac43a32f17ce446ec94a69afde4a8b77b5e5ddd0ae89c5c0aa55502

  • Size

    1.1MB

  • MD5

    654695ad618f0e4759ae3374638bcedd

  • SHA1

    4c6b7fe9d13305a60db64a8408fa3f08fda72710

  • SHA256

    34160bb03ac43a32f17ce446ec94a69afde4a8b77b5e5ddd0ae89c5c0aa55502

  • SHA512

    f67f98cd8e1eac8ad9a70c7ddb658eecc40882900fd4796a4e1203dfbd408a95f1db3c8699fc535e9683fd2e67c5189d82d1bb76f33880f430f8fe12d15fba6d

  • SSDEEP

    24576:Tyvsp1gidHEVjuFVqtMA0Eqog2k8T+/SXgcS:mS1BEVOVqBnqoRksQ

  Score

  10^/10

  redlinejambamizerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1