Extracted

Extracted

• • Target

    5a1397f60fce2f0e633b94c14929d1dcc484aba88be472b5e6e5a455441284c3

  • Size

    787KB

  • MD5

    638a0ebac0155ee4ae3f9753a82e1b5e

  • SHA1

    79bc88021052b9f84f8df12570ec275b2c7802b5

  • SHA256

    5a1397f60fce2f0e633b94c14929d1dcc484aba88be472b5e6e5a455441284c3

  • SHA512

    a2a8602b60943dcd97f712483ba6e35a4d9f0f0d0dbfa00c6141fa6e10c36ee9788bca9e9c3c569fd1241897a4699e16f31ac9f2bde43a51428696a22a58e2cc

  • SSDEEP

    12288:uMrxy90BHfh0zpxMN0bt/7RpdTgNTy2IiTLGtzKnPc2sPX2uixRHHPCjK:nyWfh8zc05/7DeeQGtOPovEHv7

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1