Extracted

Extracted

• • Target

    e5fc1de87f2b48f20c76989fe1f38bc76c8ed9ed86c49568a2f00f2fbda348a3

  • Size

    768KB

  • MD5

    a54595849028df4bda34a3ded6c74912

  • SHA1

    ce2ae3ef560b75653bbe27aaffcae0f1fbd47bf3

  • SHA256

    e5fc1de87f2b48f20c76989fe1f38bc76c8ed9ed86c49568a2f00f2fbda348a3

  • SHA512

    5abe11873bdf4824497d8ffbe66401aba9fdbb8e4981431782a6097c74fbd4684d21629ce3d5fba0552619e99c33facb7b13af76a0774c410ad5a5d9fa2aa14a

  • SSDEEP

    12288:oMr8y90sAeUOcRk1gPZQkoOuEZlVzqeVuZEKqC4vm8LG9NjvGkBtxnM8tIW+FED9:UyIjugGkoS4J3LDNjukzxM81+U

  Score

  10^/10

  redlinegregminadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1