Extracted

Extracted

• • Target

    090c3cb6e9d19fd8e45158d2764d4079944a91e046c16161b20ce069584b720d

  • Size

    767KB

  • MD5

    1c073a7cdec912cd8a3dd894964f50d0

  • SHA1

    de8018ce906516a110c80c9d442e1d3ed9af7948

  • SHA256

    090c3cb6e9d19fd8e45158d2764d4079944a91e046c16161b20ce069584b720d

  • SHA512

    48e1a47d7817a5542c89f3e5e6c9d87f69acdb771e0f94a4d649e9fecbd82def3d7b0780332c54090a81b1b821d019b2aba43d5f8e6e1591cbcd2d6a5ad07a1b

  • SSDEEP

    12288:GMrvy905O3PRBEYFQ7VP8Vsq3gKBFnYI1tmVzLUjDn0kBljnMLtIW+WESO:RyZ3PRSYKP8Vn3hNWBLC0kzjML1+N

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1