Extracted

Extracted

• • Target

    d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727

  • Size

    787KB

  • MD5

    1ab08e9c8bfd80d75bc34961d809656d

  • SHA1

    de7da0e63dad026ad7f085bbeb64a188a950dfb9

  • SHA256

    d21d3ce622954c31ea7b3c69ee8623e22e8bf3677d4f95b4f54d410f24f02727

  • SHA512

    d711df2e9b745b404d0f58b70c0b2cf92e980fdf16079765caca0c0770411a373179bae5704f39b916dade8994365153192afccadcd92b509057f4f052ef4efb

  • SSDEEP

    12288:BMrYy90ZedXmScjTOMxDVQ0/T9RDTBsVi64IzdmazjoAM3f2bPX2uixRubd:VyBdXmSYTOsDfRO4IzdJzjoABvQubd

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1