Extracted

Extracted

• • Target

    2f5079aa5054888becc752de4faeb986c783a9aa1a93b7052ecc543f0c9d3f3b

  • Size

    984KB

  • MD5

    7a09013ce9da0eaa8d2ff695d5eb1712

  • SHA1

    4738060b2a93cc477778ce562ae405a337ba1f9f

  • SHA256

    2f5079aa5054888becc752de4faeb986c783a9aa1a93b7052ecc543f0c9d3f3b

  • SHA512

    9f54a8f2a19a21968d872a74e608101df931d79ad5345c3e3e33223242e38122db5f3d618cd1611d0cb6fe345a373d7147c7a62ce05546880ef687d6b7b17a8b

  • SSDEEP

    12288:wMrDy90N2CDxwU5++9aWBHa1lLUoZK/0TsAyRWgTqxvoh/ohD8mY9+s1VKfBAuPG:jye2KNUlLUp/R9TqGyh4cZAuPfqlehS

  Score

  10^/10

  redlinedizaebaldiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1