Extracted

Extracted

• • Target

    c20f2c40b6bf284a7fdea7d2a6c13c6de35ddbf6f6c97a355e30747046d55748

  • Size

    753KB

  • MD5

    034a6e1436f00e1ddfeaf89d0fcc182b

  • SHA1

    7cf8111fa2eccaae5cb326b0a050f901666b9c6d

  • SHA256

    c20f2c40b6bf284a7fdea7d2a6c13c6de35ddbf6f6c97a355e30747046d55748

  • SHA512

    074e11fa136858dff14973a833259f7af8fbabf0f60a31616c0c78679c5a7a2ac3873a80c19f4f0f10c9362f1d9767966072c5c035b7a257a803635adc7d0d85

  • SSDEEP

    12288:8MrBy90jcYxH0nxFpH8XTwEMP695nULSCqPo9k6+zZDcDlM5:tybMHO2XUP68SlPo9k6GZwDlM5

  Score

  10^/10

  redlinemarsnitrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1