Extracted

• • Target

    e9cec382fb8e542af7734024b290139dba6aa7b0b82627d3f674e06b7a129dd4

  • Size

    1.0MB

  • MD5

    562f4e4b0c3dbedf730819a3619a8a77

  • SHA1

    856063505e9b0675cca2498af30d1c2151f3f633

  • SHA256

    e9cec382fb8e542af7734024b290139dba6aa7b0b82627d3f674e06b7a129dd4

  • SHA512

    50973773e66f0b886d97c4010d818c8e3a4f262023b91b8d0e6668e44e5d1088f86f10af9c0945997126e0ff1a30c7e3bcfbc118f6b970f1262b5ff38a102110

  • SSDEEP

    24576:JyvpQ7xkxwS0m9uq+xM05Ga72GnL3xD2hRtNLvq/xx:8WkxwS0GuqYXQafT52rtNLC5

  Score

  10^/10

  redlinemixadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1