Extracted

Extracted

• • Target

    a6f73c0be8f29e793a5c08370807cb9a715de35f647712dc600d733203b6e376

  • Size

    753KB

  • MD5

    1df8588032b505af0d63b5afdb5cb82c

  • SHA1

    d5dfc08062e756fce1d65222dd8454924efba2b2

  • SHA256

    a6f73c0be8f29e793a5c08370807cb9a715de35f647712dc600d733203b6e376

  • SHA512

    78f7779b344c144ef63c257b6d20f16afba941e54f5440cb2747f992152a5e5acbae4976ecba3e83bf7f589caf804a71395740477a992af95041e1076a997c73

  • SSDEEP

    12288:QMrpy90uuc7s2dcbQUb4KYzig/AR4A2VjPZPfFhhXQ/b02wy8BUbLAXBu4z7N:pyOn6c8eRSvA2VjZf202wtBLVzp

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1