Extracted

Extracted

• • Target

    e0995c7e64c8448a14a4a9fa3904f28bf53abf7292b0601d2419c9c9f741bc68

  • Size

    803KB

  • MD5

    02411b0f7919e70fd3176a7a1bf4a489

  • SHA1

    65918a6b7f5372838af0db9aea26948d3a0aa525

  • SHA256

    e0995c7e64c8448a14a4a9fa3904f28bf53abf7292b0601d2419c9c9f741bc68

  • SHA512

    3e635d13c037d61f4f090104e3666424ca0e77688d89da6f6e05ada33915e9092a1073f76f9c274db5ca85ac688be33d725123277b3fe7e87dc5a0c4076d4438

  • SSDEEP

    12288:LMr+y90iudnJl2EEspTOu5ViiBOnw3FgUiEVVh7YjEl9cvt3JD4u2CE:VyrGCEEcNVi+Ow3Hx72y9sRJDOf

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1