Extracted

Extracted

• • Target

    239066c44c5a9cbb85702a7169750f7280decad638fa4dd36566544a21f6950c

  • Size

    754KB

  • MD5

    d6f5445ca01c5e3c33a0ed88b28c70ae

  • SHA1

    ee4de573298aac2892e45e7e2d87610327ccd599

  • SHA256

    239066c44c5a9cbb85702a7169750f7280decad638fa4dd36566544a21f6950c

  • SHA512

    4353f4542913f49fc5037f16ce3177041d2fe436c227944739ce497f09f17b008d887f267c1f56ddf680c99595f5ffd0e026d2f0030f88a951bf91932943508f

  • SSDEEP

    12288:NMrty90rvohWud7F2ngAcofkUbwN5DmJm6klcwrbZB9Gm4t:oyUAsCTo8AwTm86PwrFe/t

  Score

  10^/10

  redlinegrommarsdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1