Extracted

• • Target

    e1e0ed0a731231dcef1f3e4dc772b160caacb0858d110e82fa28eeda405eeeb3

  • Size

    1.0MB

  • MD5

    747e043fe22e6e58d9a79079bbf09d13

  • SHA1

    ea8d1423d8444ba77f85e86418e42eccdb7e70cc

  • SHA256

    e1e0ed0a731231dcef1f3e4dc772b160caacb0858d110e82fa28eeda405eeeb3

  • SHA512

    426d19749c202474fa34169603c50fb605d65df1a1525413b9abf3badd44e3f6a22fc1faea02cfe9be807d9b80cc4225921b9087795ba0802586614443471fb1

  • SSDEEP

    24576:cy+8QKDMVCPrpiGaTEeNCaIuCJLPTCJSJPINEevcT:LhI4ViFTEaCa+JLrZPoE

  Score

  10^/10

  redlinelunadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1