Extracted

Extracted

• • Target

    8364f95e15e881bc650fe5e06d1717ea4e962c57ef7753b34cededee339acb27

  • Size

    1.1MB

  • MD5

    272304b247f68aa84ea58f4375dd163e

  • SHA1

    058e88290a78a292d85fbc3deee42f16ee42529b

  • SHA256

    8364f95e15e881bc650fe5e06d1717ea4e962c57ef7753b34cededee339acb27

  • SHA512

    3d75dfcce13a34a5bc9278fb52ddae2c2505ddfdc200326a581468cbbd9dd89abed896454e04337b0ab9968483c4dfd54a7c510de4c187ffa22c9c5a31598439

  • SSDEEP

    24576:/y9SjYkds+khvIA/SlNqoi8VJ+s7+a6nnM2GzZgky3R/v5e5SGi:K9S846vNoNqoi8V4s7+5M2+O3RyP

  Score

  10^/10

  redlinedamasisterdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1