Extracted

• • Target

    015148824f62745ae12c6352266b53b983ade0fca2ae11d5413b56ba84754542

  • Size

    1.0MB

  • MD5

    49e2e11a70dc3fce8b886e02408802e7

  • SHA1

    2bc85abbf30965f88486b5159cda081424001f95

  • SHA256

    015148824f62745ae12c6352266b53b983ade0fca2ae11d5413b56ba84754542

  • SHA512

    7f982736aa5fc94b584fa99b0d25b8c8329a35ee9d2b5dd63ed4e817e1d1dcb303bf9eda42c405132ee9c7cab2143c039413907cffa402d45934b17d1a788454

  • SSDEEP

    12288:vMrry90+wQ4ZSpH03WEXIJjz3Rq15/zf3UyXYN44fmFLjuHG9NZpgqIrPjbl+18r:kycgC3lXMzhqPrfGVUuurIrPd4PLsv7

  Score

  10^/10

  redlinemaxadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1