Extracted

Extracted

• • Target

    41cad81e3f748292c9ce5701dd81ca61717106f2d9236651d6c666b1c655f676

  • Size

    752KB

  • MD5

    d90d97270e3c3285a411242861102fbd

  • SHA1

    174b6f4afd0d1c15c1c3d954253f3e1cd2a4a40c

  • SHA256

    41cad81e3f748292c9ce5701dd81ca61717106f2d9236651d6c666b1c655f676

  • SHA512

    7b019a36e53586db97b30fb6f1d0cbd87670af5cdca0fb1e1ab28396228905540e61a7d682a15bf0d49d01aa8f95ec96fd9fe8e42dc631ead21ffb8ea8098ea1

  • SSDEEP

    12288:nMrVy90i3tjK1Sx2ur7US72KHfZLc3UcGn+psGuGbM97onJjrJ6GUXpyMQBT:uyT4/KlBGvsGLMGJh6f2B

  Score

  10^/10

  redlinegrommarsdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1