Extracted

Extracted

• • Target

    719d9cf59f9129e81585dc0162a063c85b96e753357401a7703daa857262ca74

  • Size

    1.1MB

  • MD5

    1c5c4fa02e886f815047a9b81e7f520b

  • SHA1

    e1253f2c3c9ec225d1361649ec124d242ec87650

  • SHA256

    719d9cf59f9129e81585dc0162a063c85b96e753357401a7703daa857262ca74

  • SHA512

    53adca73a4461bfe3dfa35e59f6dd1dd1951e065dc9250e62deb6d30861ddaa788a1bdb11d12c82cacf44535d80cb35afd6ab738f82fafdf97e01a37d4c6c35c

  • SSDEEP

    24576:DyQ0Vj4T496kBnzIjM/hThHn/3vbsuDzACldi0uqqvwW5+hkxbLz6:WQ0x0Nk9IOfvzAGi0uJYWQhkd

  Score

  10^/10

  redlinedoponsraladiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1