Extracted

Extracted

• • Target

    9f11fafedd2431c67115fc8b1eea3acd087802f5a3770a0a57906231726cae89

  • Size

    1.1MB

  • MD5

    72361b9ac961ae2ec3e94022f1ccb0a6

  • SHA1

    e93797dc19520ba933ffb860449c12b5c6beccdd

  • SHA256

    9f11fafedd2431c67115fc8b1eea3acd087802f5a3770a0a57906231726cae89

  • SHA512

    20807737781e7f55d716185ccf585658bc3d0bc4b78c52e9185742297cb5a64558e51eadecd145a232078c0e70e7cde79b088727adf00883b2d121b23e0f4b8f

  • SSDEEP

    24576:5ygV7gU38KOObckOMCYOMSNdA3kLfycOBVh1YWNmo:sgiUlOUckOMCBiUTyvY

  Score

  10^/10

  redlinelukaterradiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1