Extracted

• • Target

    95bc9eb9380220f909368293a7f9739396b30762664b65e0448829b3953d7eaf

  • Size

    916KB

  • MD5

    d230b564f64cbf434c4c003fda74291a

  • SHA1

    fa59504043be156c21e7025c26ec3451e8f5bf73

  • SHA256

    95bc9eb9380220f909368293a7f9739396b30762664b65e0448829b3953d7eaf

  • SHA512

    85421438a4cfa3ddd7a1fd3a4a8f3d4a95f96e5cf92ca2567a3ec815235bfc4a5159cdd3939b5cc20eee61ac03d4354097031b96e62e51afb67d217dcdb6c26b

  • SSDEEP

    12288:dMrcy90M1gexsERtYx9YNemBzIHjejNhninJj4vfN45BAqERrBh4VPXi+wIn0N6j:Zy/pxSgwmx7Rip6N45BAHR9hR+xI7U

  Score

  10^/10

  redlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1