Extracted

Extracted

• • Target

    cb0cd7a5d8d4cbeb6c31eba2431fdb1cb63b8f2b88f83fde274426d97550925f

  • Size

    1.1MB

  • MD5

    c4408420723f3dcd801a274b351f1ca8

  • SHA1

    026c44c550f9b46b55d1a90ae95ecd97c18efe88

  • SHA256

    cb0cd7a5d8d4cbeb6c31eba2431fdb1cb63b8f2b88f83fde274426d97550925f

  • SHA512

    6407b024db63d42742fd5c2f65bdd8e2dfc908bd33b12a2a8823ac88303ca974f90180378d36d9e18c860b063989edfaed37769d38c2c808cc21e4adcc1d7530

  • SSDEEP

    24576:Xy5QDEbz5wRGcDfLyY7H3OZBa4ol2sL5TfAjLMs:i5QSVwRGcDfZTqIQsL2PM

  Score

  10^/10

  redlinelarrywarumdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1