Extracted

• • Target

    cccc9bf8279ac600bc8c699421c6395f79876ccf40146facaf255f80c488965f

  • Size

    1019KB

  • MD5

    2abb5dc877dc68cec17e58d0ba6f53fb

  • SHA1

    0bb6c2dfba15a2a5b0e2c9a5e9e6ec401371ffaa

  • SHA256

    cccc9bf8279ac600bc8c699421c6395f79876ccf40146facaf255f80c488965f

  • SHA512

    276bd652c133406b8718cc26c8af7f3cddf13f4658f30137021bc3e4f52ce0f532ecb23cecfd2fae7205ded1b9626d4b8e6af15b11d647eebe1b9f886eeeeac8

  • SSDEEP

    12288:0Mrny90GXT9JIX+xiWq2pjtvuno/xrTvWM8mUod5KV4KkUJx2Ahc634kyu3Kgyfm:jypXNxrq2phvuSnvNUY4k6R3tyffRc

  Score

  10^/10

  redlinelixdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1