Extracted

Extracted

• • Target

    b632971f07a7c43d37e2de63c10eaf1c11809b6bd692c2957fb7552b4202dea3

  • Size

    983KB

  • MD5

    b7c543af6235c973dd36348e97345712

  • SHA1

    89b679fcb25c634d2aa49d4afadbdec805355e71

  • SHA256

    b632971f07a7c43d37e2de63c10eaf1c11809b6bd692c2957fb7552b4202dea3

  • SHA512

    07cd08964e5db1944f895824576c5ba0555ce07673ff96a376ec4e9bab7d204a5be872be92bf68d436621c91fd4ca761922a467a2c91613371839000b6b28f7e

  • SSDEEP

    12288:HMrgy90NbElrBVRA1p/Vx/ydgnKW+ewdZDmqYEhROLgTGx3OR/2h+f11CnS7ftAq:7yooB8babewdbuETGwghqzFA7PfTeTF

  Score

  10^/10

  redlineebalmaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1