Extracted

Extracted

• • Target

    87972d85928d3a36bbe5c78551b9f1f88b42e0523cb8643bcf34071250013842

  • Size

    1.1MB

  • MD5

    b25ed68131f4b97ad44a304cef7ca534

  • SHA1

    583bfa3b1bfd0e6f9e57dd293e66998175f0dbf6

  • SHA256

    87972d85928d3a36bbe5c78551b9f1f88b42e0523cb8643bcf34071250013842

  • SHA512

    6ace31d5ab25122db40fb855a7b2d7c62a577cce4e12598366feb8b16347bae5a9bdf824e1ca49e7102bba1c42d4e72cfe4cdbcbf3c31297a7c31664477413c2

  • SSDEEP

    24576:fyD0HUAM5qbwutfq2TdIOAPPSvVbxA19xDB:qD07M5qMutftdenYVa19xD

  Score

  10^/10

  redlinedemisnaherdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1