Extracted

• • Target

    0ba7b786db6cb34cf100a40b9452a8b348e3123e92ef4336ba76061f7835c63f

  • Size

    1.0MB

  • MD5

    36f27d70dc1ec8aea6270fb403722827

  • SHA1

    68423b32389af05273dbeeca94246e920dd0b700

  • SHA256

    0ba7b786db6cb34cf100a40b9452a8b348e3123e92ef4336ba76061f7835c63f

  • SHA512

    78417fe5d241f2d6c3c1aaf89da10d23c6147f03556edb150e1a37b5db04d714c78d628befcd0f794b37b03e5315c9563e9f345fae84d52369e2ed0387aed4e8

  • SSDEEP

    24576:VywbfU4mFPbjro9mF6spQ5EVCIZTGIwNd9y9sTcHuDoOlMBNg:wwDkFPbnUsiWb4DjToucu

  Score

  10^/10

  redlinemerendiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1