Extracted

Extracted

• • Target

    422fc150b7eeecbb69508b8ec3b4aa4b784fb37e678f095691f3d4cd3b4e33da

  • Size

    753KB

  • MD5

    00959a1282ae1c9264eaeeb413abbc57

  • SHA1

    f33b84879892b15c3187472c43a345296edd7e4f

  • SHA256

    422fc150b7eeecbb69508b8ec3b4aa4b784fb37e678f095691f3d4cd3b4e33da

  • SHA512

    3f3a5f4a373feb48e40bb5c3be7feba80207d6af78e32892ce9dbb854e0873e0628aba160966a20e53bf30e9e131bcc4694d387a84528495f086ba6ffa859330

  • SSDEEP

    12288:zMrby90gBoeDk58NQ6cjX3+bhl+SbPkoHFNrph0Fk1ELtfkd29m6X1lctH:8yDWeQCi9X3ifPkQvb0MELZhm6X1lct

  Score

  10^/10

  redlinedusaronindiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1