Extracted

Extracted

• • Target

    a3efe98d3d853ecaf2edc69edd94d489b6db4a7c8e6969b3cb2fa48a2dc337db

  • Size

    873KB

  • MD5

    6561801c4d7b3989c54ed493ce06dfaa

  • SHA1

    e983f7f9d5f40069cad0008460f293d289fe22ec

  • SHA256

    a3efe98d3d853ecaf2edc69edd94d489b6db4a7c8e6969b3cb2fa48a2dc337db

  • SHA512

    bbde2137ef96e689f7df6efe56905ddb8826f92a16b9573a60f62991db455116369d0e94951b2d94bebf6bf9e7e13733d55f24bd1e2180337862b8afec92546e

  • SSDEEP

    12288:BMr/y90OYm9sJzGhb9yGnyfNp8a4uzntjZYQ3GH/Gd+rAleNkb4axCq65zEUDxe4:6yRWBeAGyfN3RGfGUUlsY4axuS6

  Score

  10^/10

  redlinemaximesudiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1