Extracted

Extracted

• • Target

    97d50b7a9e2c358c40a6fd49d57cc0450c704c1c28dec18e88c9273504bb858e

  • Size

    754KB

  • MD5

    a2f372fb5fb9edb7eaee70aaad79be82

  • SHA1

    c4b86e66e89c1aaee2b3c55d66a852c4ed4842fe

  • SHA256

    97d50b7a9e2c358c40a6fd49d57cc0450c704c1c28dec18e88c9273504bb858e

  • SHA512

    36965f8ee29abc46a2c969f07a04888f3d4d43b92f261eb6619072e9fc1174690308ab57797e4b13ec22a5caff7fc2f3ea766f5c92f9258cf3ba170950929042

  • SSDEEP

    12288:rMrey90pRRi5EOOgiog4nEuiI67VnrF3Th1zf2ygFq6pEytD0AHtFLBvjZ:hy+HgEOOgBhnE0EZ3Th1fpgFq6HtYkvN

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1