Extracted

Extracted

Extracted

• • Target

    ec6b1a9612f5e6c9f72ce86531826e34757c567b3251562d1ea1460fef28b107

  • Size

    1.1MB

  • MD5

    6dda4fb192587e735a46f8b352fff068

  • SHA1

    c4ec9a0e321abe3d90be3ddf190951963478563d

  • SHA256

    ec6b1a9612f5e6c9f72ce86531826e34757c567b3251562d1ea1460fef28b107

  • SHA512

    a29c29449af64f5dd9eaca1cad7522c611a7baf2ea61d2744289ec6a92ad4bd755ed7af6076cad2d14c8a550c6f547ab122a2ef9b56789b6f3466c9143832794

  • SSDEEP

    24576:eyv5rmO6f2Xdm7J5va2V1Ng77r8EN0rOpslVCG/Q:tRmOXdm7JpanrKrOilb

  Score

  10^/10

  redlinelarrywarumdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1