Extracted

Extracted

• • Target

    c56ddf7422c2f95b38217f9d1ac993d04e73070e4bbb5ba2ebacf2922be0139c

  • Size

    1.0MB

  • MD5

    ecc3de31bd3ea12ee872bfb87742f5c4

  • SHA1

    45f59d396c13169a630a25f74e88eef40d92ce3a

  • SHA256

    c56ddf7422c2f95b38217f9d1ac993d04e73070e4bbb5ba2ebacf2922be0139c

  • SHA512

    71779813610ec8b50f385e536432df66669d45d909c9b65d87400c4b6693f5bbb5005acce153170a6b5c0bf728a7445406f1c6981027a32b9893cfc8a80e337f

  • SSDEEP

    24576:DyL0eiW+OnGNAC7i4CnBFMS1YAoxTelPy01ffwc:WL0zOnGNAuBCgAielc

  Score

  10^/10

  redlinedinafashdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1