Extracted

Extracted

• • Target

    5302d94a29f482b48aef7edbfe8e4fb999e40fd45fe4c30a2cd794301fe4c6d6

  • Size

    731KB

  • MD5

    f17698ca0f96d6f309df609656417970

  • SHA1

    ede32021351ab6ef20befbd2087eb0303072d0c5

  • SHA256

    5302d94a29f482b48aef7edbfe8e4fb999e40fd45fe4c30a2cd794301fe4c6d6

  • SHA512

    46b8fe86ab8a7880a8e6293b16fdee44a2f377e08692e1efabb441d42a4f024af3e0c3e3a1261dcd4360374e0d0a73a4178e491c26c74f69f87d461c463b0f57

  • SSDEEP

    12288:/Mrqy90LPXdXP+pmi5WPMgMuF6HUz6I8iA/HVGS6uyMFH1bM:9y4d25c3ZF6HU7qUSL51bM

  Score

  10^/10

  redlinedusatindadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1