Extracted

Extracted

• • Target

    39a5dadccfdfa7709c1dd1d42afb26550cd7de0a3e2192ee686d989d88953e43

  • Size

    753KB

  • MD5

    93e72991681a534c3ee868d05a3b8262

  • SHA1

    71e3892c467e563c0b8a0e6a169d06ce492850ec

  • SHA256

    39a5dadccfdfa7709c1dd1d42afb26550cd7de0a3e2192ee686d989d88953e43

  • SHA512

    072dc13b6fc2bc4ce156b64db02d38c638e503d0b0ba6731e8e4d25a37ab5f6fbf9dc981c4c2516d53bbc3cc46692a5f3c85a1e8d94bd1aa469ae25cf4e550ef

  • SSDEEP

    12288:yMrOy90JqbDo8dTZHkjxzDdW8E/W6VFdUTspczhOttEWRiH7qgYki/aZ6VXs7tU+:IyLHfd1wxlWJ/W6VsTspBNg9+/yVbRx

  Score

  10^/10

  redlinedizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1