Extracted

• • Target

    a07a42a8c969b8243f6e4cd57bb75701e56db5f4884a8342910fd8e1d4c4ad7e

  • Size

    1.0MB

  • MD5

    953e787e2b119732bb91dc2ee26e7aa2

  • SHA1

    3a8465e4fc2f52a5ee8a726b4f47ad5eaf5a25e4

  • SHA256

    a07a42a8c969b8243f6e4cd57bb75701e56db5f4884a8342910fd8e1d4c4ad7e

  • SHA512

    9c09b138bdc0108a948223dac0e3d062e58a8e4454e57ebd6e6bc2d2156534424e7d8f2d6071d2817efe733241d82244ba7c0237cb822616360fc4bedfadaecd

  • SSDEEP

    24576:Ny3R4WhpvTP/i+vqhxTlBLCO8jFLacaTFsGDea8u:o3PXJ2TlB+JO7T+GDev

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1