Extracted

Extracted

• • Target

    37ce58b257b336c415117009e4538347b898164a5e4655ba6cd9033d84939819

  • Size

    768KB

  • MD5

    e012337cede3d0371b9e164732fe491a

  • SHA1

    56fda3c31d243be18097109da62e5630c5d0ac4b

  • SHA256

    37ce58b257b336c415117009e4538347b898164a5e4655ba6cd9033d84939819

  • SHA512

    3e68fd34fce709f765ea55743365160c0a3a37f30b19ae0bdb6735220f88c463c53c481dc1c439c503479e30e5aa583935b0ddfe15b659ee8ec27612189d4dc0

  • SSDEEP

    12288:3Mrly90Z9L4BxzBiT++xtFHwoLDp/dScLL4NFE8iK3p+GH80xzV6n0kBEunMLtIL:uyu9L4vNiTlvuskFyK3oshy0kmuML1+V

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1