Extracted

Extracted

• • Target

    af9ce2a98b21323f23b9f74eaf07c52194ce93c37579632ac17739b8f890f385

  • Size

    767KB

  • MD5

    885d9f1a910d9cf673b483c95972d8a1

  • SHA1

    de4af9fc18c8bd4d3ad7dc18caaa2d866630a681

  • SHA256

    af9ce2a98b21323f23b9f74eaf07c52194ce93c37579632ac17739b8f890f385

  • SHA512

    1e38b2c62f072c16470e3b478f2b191a54e0e48eced5f0237080ca3cb319c521b0f0d1e4f6cc4d0251266e2d1ba7ae382d6bec67ec89e7c4887c2274572a1c75

  • SSDEEP

    12288:4MrMy90v5AvGT4kBRtQ7eH1XPiqBmIRzjT0O8A/qk4U4ptN0pPkQvqfArokBOvnf:UyM5AOskBY7CXPyIhjoO8zhrrEqfAEkw

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1