Extracted

• • Target

    c8486e2315f97bc555d05101bab6091852fed7cab2a1df87cd2ed21c4b7a530e

  • Size

    1.0MB

  • MD5

    03dd7e2ba636f851b9cf182d934cca5c

  • SHA1

    eb8a14a5c7040087431bb504fdfe52096ed30372

  • SHA256

    c8486e2315f97bc555d05101bab6091852fed7cab2a1df87cd2ed21c4b7a530e

  • SHA512

    eb4c43d619a7213d553b381d94bebc5562fe1f3d9b28af4f3bbc3f93d637b389c3eee253fbc250986a1f55e308c36dd7bdaa63477f500045abf2df1e95de0837

  • SSDEEP

    24576:kys83ueGhl40N98K33b7KFEfDkg/zLLCqisdI:zr3ghlxNJ3bsEfDX2t

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1