Extracted

Extracted

• • Target

    f78165cb18a36b6ee9f2bb589cdd211518d79433ac9b9440fcf5616afcb3bfc0

  • Size

    730KB

  • MD5

    27aab3d1ffcae8b3f41b0f65a796057e

  • SHA1

    ff0b6becfa6fb6fd0c0bdd350116eba67fb006f9

  • SHA256

    f78165cb18a36b6ee9f2bb589cdd211518d79433ac9b9440fcf5616afcb3bfc0

  • SHA512

    4c8fe0457ad88125a857aa3ce2d79133972f4ede5558d0f3cfdc765f165202744aea07bc58bddbc59882885a8ef06dabb0e49f947455e4ba06e1705826ea42dd

  • SSDEEP

    12288:fMr8y90D2SvJpKyKNREcU81HIuLBQ4JVGBp8d7vJe6LEvQ6ci00hPE:Tye2C/KN+cLW2BMpU1LEvMcE

  Score

  10^/10

  redlinedusatindadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1