Extracted

Extracted

• • Target

    57f77cf9a41813ffdc4cf4a9ed1c36d7265983e52d0e7b212baf4e217ea55735

  • Size

    771KB

  • MD5

    42d96620695d0c672e6ad6398694e90f

  • SHA1

    6b9da3b333b2e64f08840f627ecf9da3ee63abcc

  • SHA256

    57f77cf9a41813ffdc4cf4a9ed1c36d7265983e52d0e7b212baf4e217ea55735

  • SHA512

    be4e1fa2166dd6c1291f86d6dddbb689e9d9ddcad64e72da66856ce4348c4777e35f72ef291f7b4f5ed73013fbf119e6ff77cff440a47f810db3c3875074303b

  • SSDEEP

    24576:ZypEkd0HwhMALln4h4OlIYPjs390fJbvjGbWqD:MrEwhj1YPQtgxv

  Score

  10^/10

  redlinedisagogadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1