Extracted

• • Target

    afd9b154f6e014ab4264421e2dfd07e728a4700e12f31282875b05c89cac3332

  • Size

    1.0MB

  • MD5

    cb425bd2fe445e5fbc9ae019467b51c4

  • SHA1

    3467ce31fc9268e75e4632f58da2164a34b33077

  • SHA256

    afd9b154f6e014ab4264421e2dfd07e728a4700e12f31282875b05c89cac3332

  • SHA512

    27ec63daf75b8cfd1925c0b38dd160654452bb44f00b01bac1638e569986324ab7d6aaa73a7fe8fff509bd50cca30ffb25fdc6612fd6cf5d0d3ce1080ec26b4c

  • SSDEEP

    24576:cyaP9uzs+A80X4uruQAk7lbxbH+bvXqJyikL:La19h9rTAk7Leb/q

  Score

  10^/10

  redlinelunadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2