Extracted

Extracted

• • Target

    31908da4ef1c61b93a3e73612b1cbbdbcfe293e84f83899a9ae3e99c5c4d9b7a

  • Size

    1.1MB

  • MD5

    b181f12df098a48602b60ff1746fe58b

  • SHA1

    e3179a04c9f0f901714ddb8c8f5d6cbb7bb0bf1d

  • SHA256

    31908da4ef1c61b93a3e73612b1cbbdbcfe293e84f83899a9ae3e99c5c4d9b7a

  • SHA512

    a3a94ba7144e35b0880eff2d63c644fda9691756f218c4c8d3339a7e1fa2438144e5c7f0bc1eab0cfad06dbbe99622eaa1ca109bb3b59ddfd1cc3c7f8c065195

  • SSDEEP

    12288:BMrXy90FhVnUmHA9WHC3VjWBHjd8c73p5yDr/uTLCOrMg+OqaqxJbh/g7nwWF6HK:GyaUAHC03aDeCOrMgcnwnwM+X1kG2R7

  Score

  10^/10

  redlinedestojacksdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1