Extracted

Extracted

• • Target

    32e099b89b9a45483dfdeb8bee9f235476122d6f7b3f28cd6d17568ff494b795

  • Size

    1.1MB

  • MD5

    14676def7481a172b029fb5c0b92ca46

  • SHA1

    03de8422c0cba0ad0f4604e1cfbe4d50ea355fd5

  • SHA256

    32e099b89b9a45483dfdeb8bee9f235476122d6f7b3f28cd6d17568ff494b795

  • SHA512

    9750c68ca7b940c72d7a750944e2720ffa2e9ef6764fec14f87489cc237029ca9910b90b313369c2287e2dfcff7bbaf3030837ff6c037f454359858966b45deb

  • SSDEEP

    24576:SyfaFymUbKFHFTJcSrF2uqMPIUOFWaCOhw/KyumnJvR0FGua:5yFymUbwTauPqMPIUOYaC+oKSJ0F

  Score

  10^/10

  redlinedizanravendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1