Extracted

Extracted

• • Target

    f47bae2504d557c4b8f55d7737c9ee436a4508cf8a08aa3cdda4192d2416264e

  • Size

    768KB

  • MD5

    17ad98443b94e6e98f7aed8194f27d36

  • SHA1

    93f2e10a21d7f0eb1b3c98825b495e76401727a5

  • SHA256

    f47bae2504d557c4b8f55d7737c9ee436a4508cf8a08aa3cdda4192d2416264e

  • SHA512

    83b4bc2aadc61325b779d4f0b26ba30f0260cdea9b21b8beda8c83b3255cb2c133acb194a7bef8690cfddf166ac12d572795ad76303c93198eccf69e8f85af4d

  • SSDEEP

    12288:QMrpy905I8Ky5Ij99gIFlDylPaQAFYjdShv436pOihiJ+Q+fcavK2bWmE9CQ:py6l+j9iIlDylS5YjkhvS6/hSj+kd2bs

  Score

  10^/10

  redlinefashminadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1