Extracted

Extracted

• • Target

    87c02e69bfafb9dcde065803631e121134f6d6a9dd6fc49929920fd7a4df4471

  • Size

    770KB

  • MD5

    d5f85455d5524cfbdadf0c2bd70bf6e2

  • SHA1

    6f1fbc66c69fc424fc1d66bb53ec5391ffa3f7fd

  • SHA256

    87c02e69bfafb9dcde065803631e121134f6d6a9dd6fc49929920fd7a4df4471

  • SHA512

    231d5cfd089dd7792b12c4c4af6c165d0f7a7c4620159dec879dd6f7032ac23af564e5900efb0f2b6db3eb454844850a844fbbf04434c01379d565b13a458358

  • SSDEEP

    24576:vyLfxWwpqz7JZSWewRBTPBe0590lXbfju:6infxewRBTAeaLf

  Score

  10^/10

  redlinegogamisadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1