Extracted

Extracted

• • Target

    e5038ac19feeac52170ce20ec82d9291342aa5d979d93156cf117beb283d66de

  • Size

    1.1MB

  • MD5

    c928498691c77e20662e8c6c098c0435

  • SHA1

    bfe181431cb95260e953cac060c758beb996b3b0

  • SHA256

    e5038ac19feeac52170ce20ec82d9291342aa5d979d93156cf117beb283d66de

  • SHA512

    93c223b024a6dbc9ce6ac101ca2fa1d897281ef233e1d9c1e18f35f5322a53049d37efc6dff326c97ebcedfb5271218d89764680d9966755b046c9dbc79bb6d0

  • SSDEEP

    24576:7y2O/++/z37qkl9qN/BOm+PGjOdaPjgY3XIwJUz:uH/+sz37Lq1BtREaPjgY3XIw

  Score

  10^/10

  redlinedestojacksdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1