Extracted

Extracted

• • Target

    33e885f6e0becebbb81fd015a24cb013da0b077bc0c081a986404293470cc356

  • Size

    1.1MB

  • MD5

    b2c461e2d943176a6da0dd8225e2775e

  • SHA1

    9aab87c6191b80beabc5ed84eb6cff0cfc8e57dd

  • SHA256

    33e885f6e0becebbb81fd015a24cb013da0b077bc0c081a986404293470cc356

  • SHA512

    afd55f17cf030742505cecd71e21dd59c59d5b794a8e6faa845c10059005e781449a2b29ffc9c82668dc4a203503acd415089d353eb0d4ab49b62eb4ca4cd106

  • SSDEEP

    24576:zy81uEs6RbF30Zjo0ALEy2tICtuZld3FHmf/RhcnIveBW7BO+HS7a:GC6Kp23Ox2kZlnH6/HeU7DS7

  Score

  10^/10

  redlinemotorterradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1