Extracted

• • Target

    5a9c2d011d2e839ce36c915e867b4603c942b5390b864943067e87bde524743b

  • Size

    1.0MB

  • MD5

    5d25f6373b674d301f79ade3df6fdde9

  • SHA1

    a4380d8a1b82b4e9bfa5b0a0b4cb225277bb65ad

  • SHA256

    5a9c2d011d2e839ce36c915e867b4603c942b5390b864943067e87bde524743b

  • SHA512

    3d27e86e60ed6322ec42f1f4965882a4bd00e36d0af979f8b14258b322d3d6fd9db456f8481cefadf4000f6dd3da428a9a706c8b6fe7d9ff196f9a752eabc02f

  • SSDEEP

    24576:ry7aEV7B6kH7N1GeKwP2qJZj1f574IznV0H+zOuClwo0t:e7aExB6WHGFfqjH4IzVxOfJ

  Score

  10^/10

  redlinemaxadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1