Extracted

Extracted

• • Target

    e0dbe49b05381fb7b3e14c8d6bacc991a9610242127ce573cb29e500ebaaa2d0

  • Size

    751KB

  • MD5

    6edf0de31acfeedd7ebe1eea9262ce5b

  • SHA1

    4b7df8828115856a0dca5d053f5ec4889e5a5448

  • SHA256

    e0dbe49b05381fb7b3e14c8d6bacc991a9610242127ce573cb29e500ebaaa2d0

  • SHA512

    eac065ba5ebc4a69d83edf3420696a187c005879e02b8e80b30a7ca0c716f6da3c93b4c662c93bc27b313252384b94908b97e459b7fc448f6c9e2e230e4cd567

  • SSDEEP

    12288:tMruy90xwEJ+ltSjB6FjVbdUrC9YQq5P/7jIIvQWdAtTTnyO3wVtuPTP1U2:3yk9jBKjVberebq5LjHGtvnywwVkq2

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1