Extracted

Extracted

• • Target

    c7010712157208b14c0700fda84aa3bf64c9fb196d5e17d448a35edafde3d8d0

  • Size

    1.1MB

  • MD5

    7699bdcab41458486213b4d7dc1a61cc

  • SHA1

    13c2afe49caaf9626d6a4585be1ca8a1a1bc7526

  • SHA256

    c7010712157208b14c0700fda84aa3bf64c9fb196d5e17d448a35edafde3d8d0

  • SHA512

    ca5b6c757ef73fca9e6cbbfdd25e3c6f78f1c916eaeda34057e33885996843563115692213fb9877162e17ab9616084ba436a70c1baef3c423f62e85134ab288

  • SSDEEP

    24576:Ey7BfiyCNPmEv9DAKADtH32S5JnUhrJF8S8MOTNCn5e:T7BuBmEv/ImS5tOrbz8MOTNE

  Score

  10^/10

  redlinedigerfugadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1