Extracted

Extracted

• • Target

    313585d2d0a21bd87791ebde0e70d7243361f4b7d987dda6f483e1fc45f5abe2

  • Size

    767KB

  • MD5

    bacbb786a19dc14c6b5ef858c32ffc8a

  • SHA1

    2f155361c7c3d4c27d6da565470006f4c56769a1

  • SHA256

    313585d2d0a21bd87791ebde0e70d7243361f4b7d987dda6f483e1fc45f5abe2

  • SHA512

    4b102c64998ac328e4d586a7ec044edc5323d6379b3bb570851186c164bb9a6006e57ce98c103c9fb2619dfdbed0f23505046347953ecf4f0f3f5b81418acb39

  • SSDEEP

    12288:FMryy908GxBI0sVIgTl/9uCgjXyR8oUQhHC+HhvTILC4v+Q+fbavX2bWzE4DeVa:XymgB/Jgji6XmiwhLILzj+Di2b6yY

  Score

  10^/10

  redlinedinafashdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1