Extracted

Extracted

• • Target

    8456ad69152b60b4bfeba07d11390efd2ae12989ba2487b27e91dc5fee945df6

  • Size

    756KB

  • MD5

    7475a36d82aba5c79940bcae11917143

  • SHA1

    7bfbfe33317b7b7f30c30f1a09250c24c9582c47

  • SHA256

    8456ad69152b60b4bfeba07d11390efd2ae12989ba2487b27e91dc5fee945df6

  • SHA512

    3674fdfb17d5406bf9bec8e4aef008b6c657b72ccc9b0650ed7f45c94fcc409b5fc9dbc08841b38abb388e620dbec03493a1bcdf6debc6dc837498c3d9f641e7

  • SSDEEP

    12288:tMrry90V2XhSfGgfYhOfrSKwxBGmvNYL/gp4grqUb0GkrmGXMg89:Ky3hSfHAhO+xBG1/SV7kyMS9

  Score

  10^/10

  redlinedizarockerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1