Extracted

Extracted

• • Target

    49bcaef192e18fba9838fed854e85ec17b143b1f298efd934afb9d6cd24cf7ae

  • Size

    985KB

  • MD5

    98509b7e514f1a146978b21df2926168

  • SHA1

    1149e23d6ed002b38ea9fbf9c4870066e1bc5507

  • SHA256

    49bcaef192e18fba9838fed854e85ec17b143b1f298efd934afb9d6cd24cf7ae

  • SHA512

    5b066bafa33c643d6f7d9b66210026cb6356bb9a12f65340f2fcdbe99268450b3f7d3b74e27674956bf017863fa5d96d19ed9e18ea4d6e1254e2bc544bb3c175

  • SSDEEP

    24576:qyPXYeCh2czRHigpFIkfLGDJcOSxP+VVxq0:xPIeChzVHigQ/UP+Rq

  Score

  10^/10

  redlinehavallupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1