Extracted

Extracted

• • Target

    9f23ad853e6bdc8994f2db2b2f23cdb72d055eb561a384bc3baeb0d4c73dac10

  • Size

    1.0MB

  • MD5

    5fd2500a728c5e281eb42c3aab64940b

  • SHA1

    a06b751b804135bc89effd37057cce14660b4525

  • SHA256

    9f23ad853e6bdc8994f2db2b2f23cdb72d055eb561a384bc3baeb0d4c73dac10

  • SHA512

    cf1fe2dfe942c49796867ecb2f28446e80f97378ba6db2e08a2bfa15c9c56b425c4996de4c2c3ffcb51829fbbaefe60f53ee9c9410eab8e93ddbf675af90bed8

  • SSDEEP

    12288:cMrsy90pfY2w3kmINP/nsJAc3M3PnFwYi0oWEKT/kjE6+VKT+eyteTSFBK5d0ReY:Ayf8mQfsWv3fFw5WzbqEaTIjbGi5Fp

  Score

  10^/10

  redlinegogalisadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1