Extracted

Extracted

• • Target

    6111b9a6a3f1fb6bf6c76aa7eb64a8a2133b0a4cac1f35c62b4a667db4a5b72e

  • Size

    1.0MB

  • MD5

    9ff1722f6b4e169a30a82d4500135204

  • SHA1

    1519bc565da9e59e8904eecb1ea8cd2ce4beec1a

  • SHA256

    6111b9a6a3f1fb6bf6c76aa7eb64a8a2133b0a4cac1f35c62b4a667db4a5b72e

  • SHA512

    3f6c9f93bed34779b1113df5f8e0c2ecfb9bb976fa751d154362f232b7b9b6f2f50bd395ce9c478c2d37327f143f8abc8cac49434176cacdc63ce8ba07a613b8

  • SSDEEP

    12288:5Mrby901+gBKg+AyyoR7VP9mNIKnkwENqq7/JYPOJseRkUTqb9ryD528Tm6mB/Hp:Kyjrg+q8MIKnEnBrRaWTmjkYqTaTVr

  Score

  10^/10

  redlinelizaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1