Extracted

Extracted

• • Target

    b45d6002dfda27dd04d7269eb4aa496308bfdb5c6164fd4525d4528c72377429

  • Size

    753KB

  • MD5

    0e2d8884a18980f49b160ba363354d44

  • SHA1

    107d9972a761a04e6c5890a34f7f6cfe4c3371da

  • SHA256

    b45d6002dfda27dd04d7269eb4aa496308bfdb5c6164fd4525d4528c72377429

  • SHA512

    f796c68930599d837fbf19ed38a477d7d419d420d61ff56e7fc8ce5a0258072127cc757898d20e9f53e6eb7ecdd2201b8d2128d1cd59b0f494f9b4ef605f7e21

  • SSDEEP

    12288:6MrUy90WPXWk/OI6y5UJDyj1uDI8cLhZ552ey7OHjsd2VcLJ0dJ0Avrna:yyBFObySR88cVZ58ebsLkCA+

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1