Extracted

Extracted

• • Target

    4548ba960468a9ee912f934d274236d00e5ceff63270ffbda0d3bd3fc6996a1f

  • Size

    1.1MB

  • MD5

    6d81417cd61a2c29acd5d24e1be2b1db

  • SHA1

    707e3b6f7807480b819dbe465d4d07397c0a6874

  • SHA256

    4548ba960468a9ee912f934d274236d00e5ceff63270ffbda0d3bd3fc6996a1f

  • SHA512

    4045de36eb0eab56366a41fb6de9946332cf724699d5d52873260c649698906065c76c6626373d5b8a5bc728b5872ab855ff230851191f449e317f79cef784c8

  • SSDEEP

    24576:Fy841WpdtsrxBN4bwRNUWiuqwI47NBSWF8Fkcg0cL:g8412delBN4bwrdiMI0vF8Fk

  Score

  10^/10

  redlinelarisnaherdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1