Extracted

Extracted

• • Target

    9ee08a7b0cafb9fe0d9e5ebb49e3f9e42930c8a5558858e8bd1d5643fd5cd460

  • Size

    770KB

  • MD5

    5bb157469ad848d3cc3992cfd8a5b492

  • SHA1

    5e8cbbff3aea62fff9b6a3acfb10cfe715beec36

  • SHA256

    9ee08a7b0cafb9fe0d9e5ebb49e3f9e42930c8a5558858e8bd1d5643fd5cd460

  • SHA512

    2563732ac775a174637e6f5d7e516693f930dadb5f8789ad8aea46133446640e64d609d920f39cd23c5aa87bf7c0fd182f2f756e453d6c5e939e2751ec1b85cf

  • SSDEEP

    12288:mMr/y90BTABDk5Hk/2Dohz4LRkYazdk+h/uaC+4ucBVr8NDfe+949AIvZyo6O:NyNkxk/Zhz3XRy+4ucBVr85fe+KYzO

  Score

  10^/10

  redlineduraheroydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1