Extracted

• • Target

    9f73a9fb85f0356c737f62da44442f6aade1514da8b16bba89b1099c95b04430

  • Size

    1.0MB

  • MD5

    ec9e0148e6c9a44e656ec996dfcefbb6

  • SHA1

    83c82851798fc6ddb7dfa34d81c763fa8ed0159f

  • SHA256

    9f73a9fb85f0356c737f62da44442f6aade1514da8b16bba89b1099c95b04430

  • SHA512

    db920d3565fd102380fb31a91c634f123fdcdb36fa3c684270d3e0944c3bdfc6ee64dd0cf06a50122c9f1797ccfdcdc063bf2c7b666ba2a3680e73f2cf0c06b2

  • SSDEEP

    24576:ryfpxdGir6/KQDiBd6F9hOJFGWTNTF2CkTyTqYtXJn:exx8/HmBYHhOJoWZFcTy9t

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1