Extracted

• • Target

    54ce913c86d23108bf6fb6899195b4c9b2f04e69c0d74f37f59d2ee759a45539

  • Size

    1.0MB

  • MD5

    eb956bb8f32cb1b5c2bddd02e7a3ec32

  • SHA1

    e6e85823f8bf5bba44e55737ed950cf214dd9e6e

  • SHA256

    54ce913c86d23108bf6fb6899195b4c9b2f04e69c0d74f37f59d2ee759a45539

  • SHA512

    704840c92437c20d1daece6e3e13a5c1fb418c203f0b60016802e3bb302148ded647b1af75a18d7d8da9e402679e1883a6b7cc39162d2e3e06f8f9340e1ae986

  • SSDEEP

    12288:JMrTy90fZuJgyzftvTSSe50KiE5sFlIm5gJhnQrA8Bw1cJbxODebJffonTeQUQyf:Wyt5Zbe5ricsFlIxhn87JB0sf2TeoPm

  Score

  10^/10

  redlinemuserdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1