Extracted

Extracted

• • Target

    08dc7e8bb61220331f57f9b7d9f88462a3c0108453b90236b8b54c72a6e547c7

  • Size

    764KB

  • MD5

    7dec5c004792a035d44c2588807886b3

  • SHA1

    d02c27d71f7655eb2f1793df045863cb127bfd2f

  • SHA256

    08dc7e8bb61220331f57f9b7d9f88462a3c0108453b90236b8b54c72a6e547c7

  • SHA512

    e113dc903bfc1d4c3bc4c207d861b7c4c1713e0cdbca8666de44f8b777133b9635e326775812fc90febd64511fb6982c889c27a30edebc7a25dc8d3f1cb8bf9f

  • SSDEEP

    12288:rMrfy90PXI5rqRjDUvl4OfR4fXnZrjEK8eXjvigh72UDmII4dmEmdQLBbE4:UyLpEMt4O54fXnpYgjagbDm94gEmdUH

  Score

  10^/10

  redlinedisagogadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1