Extracted

Extracted

• • Target

    c79deb29c1652a6d1954037ee1eef99575dfc92ec6b9abaae41dccf55225492e

  • Size

    771KB

  • MD5

    c191bf53299247b8860c6e6f909838c4

  • SHA1

    40bf35056f097e4ceca8db43468e630536f34741

  • SHA256

    c79deb29c1652a6d1954037ee1eef99575dfc92ec6b9abaae41dccf55225492e

  • SHA512

    4a8b1c546fde6219f8655b3ab5f4d70073960399400b97ab7100f36caf9bfb6ee8ebb4c1360066e578dc665a1690ff238135c73910bdf255682d355d76d551e8

  • SSDEEP

    12288:jMroy90mXSlD3gWKFaFXpCoWrrKJ3G5W6g+iqvQQSFmPk3eRoJmCmTRJPmkTLiak:vyEwcFLWyJ3YWKi0Q/MkSCgJxKa4gXO

  Score

  10^/10

  redlineduraheroydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1