Extracted

Extracted

• • Target

    26978c6a2cd42c2a305af3513dfa11bda68aab7343dd4348cf68c8a1161ca3dd

  • Size

    788KB

  • MD5

    1ba29926f35d635cbc79327b4b7c2ffe

  • SHA1

    df72b5ecc8168c1f934e1bb30f2cba0b4ebbe212

  • SHA256

    26978c6a2cd42c2a305af3513dfa11bda68aab7343dd4348cf68c8a1161ca3dd

  • SHA512

    555a1c0b3332bc28a856286391b0b42c22801c7db86dc68ea70093c9b4982a38337fa9bb74a3c10f6710984c8eb9954f61e7a2bb6d377eba4ffe32b64b15cb03

  • SSDEEP

    12288:WMrOy90cu03NQu11NFIyg6jAfI9c1Ri2K8KIUT+K8Gn8U20PX2u9XRVnGS/m2:8yvQWvFgqAfAKcRnh6O8YvFhf/D

  Score

  10^/10

  redlinedizametrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1