Extracted

Extracted

• • Target

    bc942682246b364f4ed72fc86852e28f39fec3ff33d7df92a5d4971098efb8b7

  • Size

    754KB

  • MD5

    743cedad3af8256da477a07d25379f46

  • SHA1

    bae0cb2377129a29aac44be9f0bad763e469ff28

  • SHA256

    bc942682246b364f4ed72fc86852e28f39fec3ff33d7df92a5d4971098efb8b7

  • SHA512

    b8afc63ca3514bdbae054cd3ec37bcf71a52448f6e92a79391a0e8bc70839713f6136e019cccee3ec8657e6d160ab6ee4b3dd36be28e1e3d71781763eb582e92

  • SSDEEP

    12288:7Mrly90RlbWAK78Uo5ZwcXx6np4lIbuDsOLDczTn+wsRFBDRN8Z8z5pbRKzNpB:6yqbWJ4BvtMKlJ92TsRFBD/LDbRAB

  Score

  10^/10

  redlinedarsgromdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1