Extracted

Extracted

• • Target

    b09a4b654a9cdd02815df622eb76f4abe476b32a04eb2b2cacf1a4444003b104

  • Size

    1.1MB

  • MD5

    d751c801c8b6018830159a74b6e0be93

  • SHA1

    d11733f998c8bbd482b0d5fe28cfb7fa613545df

  • SHA256

    b09a4b654a9cdd02815df622eb76f4abe476b32a04eb2b2cacf1a4444003b104

  • SHA512

    f96d4833837ad8aaa94759bf4ebedd5096e439553f63f2f3eb1fcf859a579e9612ca6869acbd5897b2f978c5fcbaeef2eef6ff33a4753b837ea4666222764f9e

  • SSDEEP

    24576:Uy0uqe5AgFfIJCumAk0Lu1tOb8auQkz6WKEcIktVDyym:j5HLuR9u1wb8aWQVDyy

  Score

  10^/10

  redlinementnaherdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1