Extracted

Extracted

• • Target

    4e6dd6dab024b1c25c9fd728246276a6ca5c0159bc3dc7771ce4391877893b4d

  • Size

    1.1MB

  • MD5

    21e7371522ed51f0033e360f7d4e0b5d

  • SHA1

    a9e5b16a95556f19bf09cbb5e4024e0f73eb9242

  • SHA256

    4e6dd6dab024b1c25c9fd728246276a6ca5c0159bc3dc7771ce4391877893b4d

  • SHA512

    1a7f5f98fcc431ef71f619ad4acda55a3cabe4066879f7ea8d523504d18cfbdabf85fe0ef9f68dd7693e48853b5c63776b29f5a8d0ef7327f67bfc893fc0315e

  • SSDEEP

    24576:YyVqNoCsU43qxxH3F4ozM2j6nM6UZ3J0R+zkgxD6F8tWYE:fCoCsn3qxxH3F40MYmM6U7QgxDo80Y

  Score

  10^/10

  redlinedogmaterradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2