Extracted

Extracted

• • Target

    a714c2832b92edfd90699b736044a5a1e93974466cec52be9eba4f817236849e

  • Size

    770KB

  • MD5

    8087f06b7db9b8991c02038764589f43

  • SHA1

    5a21090826a8257736945b9115f3acad2dd6645a

  • SHA256

    a714c2832b92edfd90699b736044a5a1e93974466cec52be9eba4f817236849e

  • SHA512

    ebc514a78aa684b7fd4e1ca4d89e06ee14683706f3ccdc969900de00c3f62ee5dd39d452a799f928a68d13963829ae53b0e381e4f0588aaebe85f4f22137ec0f

  • SSDEEP

    12288:tMr1y90c7O2xU04wc03pLi43cgH9Eh1tzNctutm8T9S3+LULk3NT4Sgs:EypVH3pLXb9a/4gm8nik3ySgs

  Score

  10^/10

  redlinemundermusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1