Extracted

Extracted

• • Target

    862f0b8d9d96627f67b57cb2b2a9385178da3b5fbc734c4cbf258c624130401f

  • Size

    751KB

  • MD5

    68998758b45c2038d7f26f5768c7cb24

  • SHA1

    b36524c8f421770fe8812e89d3eb1358766c8536

  • SHA256

    862f0b8d9d96627f67b57cb2b2a9385178da3b5fbc734c4cbf258c624130401f

  • SHA512

    ace4d177bc4f8052c7fb8225833d77a6480e0254b2e3d40cd1f5dea0ed218a6e42dd1c95bb9bd4c3fbc7dc510fce46e5940fc011656df0877db0bf5d68ff20fd

  • SSDEEP

    12288:vMryy90e6lvz04JD+ZR5qjdJW4eJwt++juYzQ31WVcGhZer0MnG3y7/0T:Ryyvlx+X52teyt++TzQ31WFh00zT

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1