Extracted

Extracted

• • Target

    40e99c2ce68ce4e8923670be81cd52a9eeff49639a107b7c20c5319d92f41b64

  • Size

    761KB

  • MD5

    df6e879b9975ed2b7c45583053389b96

  • SHA1

    6ff5f1d582452c590d302048303afb93715f620f

  • SHA256

    40e99c2ce68ce4e8923670be81cd52a9eeff49639a107b7c20c5319d92f41b64

  • SHA512

    159d0ee95ef4ccdd14795def9a9f359a83dacc6b606feda3c5e0e8b172e6f4e0b158f03887b4c5e49479f289a2783124d857898d8553a6180de28a5437c85e6a

  • SSDEEP

    12288:/Mrwy90wtqrKpUzb+Nn10hB159E742LKmUitpsNrxz5DyBL2LRoX:3yh4aJ10hxjWKe4Nrsq1oX

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1