Extracted

Extracted

• • Target

    d31fb9de344d9e503cea09ab4858b8558d941f1cc5dadd356ff9db6fefd658cc

  • Size

    1.0MB

  • MD5

    2c33a6d2ae5c5a442f825708cd521553

  • SHA1

    fc2d4ecc7a1e85efd505da19cc4b63859b710143

  • SHA256

    d31fb9de344d9e503cea09ab4858b8558d941f1cc5dadd356ff9db6fefd658cc

  • SHA512

    b27a1c8518afbcea3249e0f19977fd1a93504b04ded6f65bcd4e34b577a27b99521ebf5c12139889914f1e4ca0854504c37e61f1e193c6a3f16265bc1df0e219

  • SSDEEP

    24576:wygXPoOyTrktL1YyAR30kNiM6P+FIe9dtC2qOjpci:3gV+Qt2yo3BiM6P+FIe9dtM6c

  Score

  10^/10

  redlinegreglinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1