Extracted

Extracted

• • Target

    b990d184c057648342dddd2fec112b42030d7374f1dac62a5ba13444d4e29fc3

  • Size

    760KB

  • MD5

    24e9f4c99bab824dc093adc4b14638b6

  • SHA1

    424599c9d9c6b65d26d01e5bb49f4a79ddfe1bc9

  • SHA256

    b990d184c057648342dddd2fec112b42030d7374f1dac62a5ba13444d4e29fc3

  • SHA512

    02fdcbf339422f7c435f19eba15ddd10d7fc5f33ce4eae5635576067254f1a574882cbd8f9a70c268ff6db28fdf13edb4520659428ccfb095ffc9b41b279d66f

  • SSDEEP

    12288:SMrsy90nw0qehxh6Enz41qIjXYPrLpKCHIjbScC/FNLlj5Ol1SWIUdWRh3HPFCP8:+yow0TAUz41PCLpKdjbScCxVOlIWsRhN

  Score

  10^/10

  redlinedusamunderdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1