Extracted

Extracted

• • Target

    623ed030f53104cbd70f7c678a2ca7d4a2b1fc3cd9236cadf4ab8c92f5d11811

  • Size

    771KB

  • MD5

    8c8e411340476890d8f1fe5c535fd38c

  • SHA1

    4eae87bf8ea038294f05276502be184c2edd14e6

  • SHA256

    623ed030f53104cbd70f7c678a2ca7d4a2b1fc3cd9236cadf4ab8c92f5d11811

  • SHA512

    02c12a67e219f4321a8267a219bf249e2e40f6e3b48f38b8c9713e38aa8b36e845406b71451b8ec55d5d5903c87a2e6797e430fec5924afcc0106f1e5fb54986

  • SSDEEP

    12288:hMrMy90zt4OuUB0b2cv4A5O5TFr/7vDPd/qbTAlZS0bWN9DtULk3NTeSvv3v:VyUtG1pvZsZ/7JibGZSUWN9DYk3sSvn

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1