Extracted

• • Target

    cd9a8bbd64519e8f94fa18152896d6faf964719ec95944b4f773b710ecd50edf

  • Size

    1020KB

  • MD5

    827214a89d19f416274ecad2bcfdeb25

  • SHA1

    d100b72947e55de18c21cc9e2a61faee84aa1bc6

  • SHA256

    cd9a8bbd64519e8f94fa18152896d6faf964719ec95944b4f773b710ecd50edf

  • SHA512

    48bf6901b4af8b7cd2dc5b3d212f6f6144d2ec79fa273b61f7b24bdf91167525f9059299f766136eb000290968d0fd29612211bbd08c003a841bd745e32c6d8f

  • SSDEEP

    12288:oMrJy90Alk27bEW8yCYDFE3HYnr3vygQjpxJSJrHZ4h/U/Xyr1fsWF0LVWRTX7BB:xyXRnt83on7vBQQp54h/ht5F7Rr7TDL

  Score

  10^/10

  redlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1