Extracted

Extracted

• • Target

    04ba08532792e424f140ec038019a5ef9f715c7442cabbe76efdedc40d215476

  • Size

    755KB

  • MD5

    60a11bfbdf608cd05f385f661ff4c5fb

  • SHA1

    847afaa193b43737a9bd8ecaf09c6015faff9b79

  • SHA256

    04ba08532792e424f140ec038019a5ef9f715c7442cabbe76efdedc40d215476

  • SHA512

    6cf6f4ac9296eb61a7344b079dbef2ba9fd3d3875c917f392b40b2cea347651ce9e2804c634d62972c9bbf0154f99a76a72926fb9ed98825098cb5ad87d09e80

  • SSDEEP

    12288:SMrNy90Rqyq+R+dnN9hcAs1ij2Ddo7f6UhiHGYB1pyzX9Ir0Dynk7dtO0:fyNMgeA3CqfTuGIjyzXOrcykhz

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1