Extracted

Extracted

• • Target

    eddbd36cb6305566fe534d5a989b91213869d99c77ae267189146db490edf3c7

  • Size

    768KB

  • MD5

    d39bc57a859855498d53c17c642b5237

  • SHA1

    3aab8d703d93c1608471bea9d992b66817fb49bf

  • SHA256

    eddbd36cb6305566fe534d5a989b91213869d99c77ae267189146db490edf3c7

  • SHA512

    5cde3c4eb8729a6d53518d19040a9ae591926262d1e4f0ce580047625d49ec99b91ad998e543c4fba8100039890a42aeb85f48ddc9d278bee56d20fb00140ead

  • SSDEEP

    12288:+Mrly90YrsWEVL692hDp5rv3HDWFSCFjp5uso9SloAHoxyWSkBYTnMMtIW+UE6k:7y9N2hDLfjp6jp5JbwydkeTMM1+Ak

  Score

  10^/10

  redlinedinagregdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2