Extracted

Extracted

• • Target

    e17f277f3bb90d7d1ce064377f2b8db2880468944d302b84de9251fa70e4d136

  • Size

    982KB

  • MD5

    d718a52951f6a5aa750bbdd67e5a9d88

  • SHA1

    90aebfe65e2356a8f00a398259d12b47c2641a8c

  • SHA256

    e17f277f3bb90d7d1ce064377f2b8db2880468944d302b84de9251fa70e4d136

  • SHA512

    dcc52194360a9827d9fbbd44d2fd6f8281bbc10bbb554d2b1b3913082db3a1543d1d94fb1c71fe38d686cc7fb8cd0b5ac3f8bc07cbe9a07ec30aa15008e7ec4c

  • SSDEEP

    24576:py5ux9qlLWxxbkyLjFNWTG3qh1KQ3F5FpkfV9YVdpDT:c69GLhyLjyGah1x3FRaGn

  Score

  10^/10

  redlinedizahavaldiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2