Extracted

Extracted

• • Target

    b63e22026eb8524ae8981cd373e68451740afbd390ae31485c093a65a4a2396e

  • Size

    785KB

  • MD5

    2f80598e8d89643783e2568299a42f1e

  • SHA1

    45503ba5fc9c868624e28af22bc2959147cf2ccd

  • SHA256

    b63e22026eb8524ae8981cd373e68451740afbd390ae31485c093a65a4a2396e

  • SHA512

    0aae387778307f58f64b648b772474b4aafe94b515981790658088497a723e9bbe377a1b3b3ea6133e112323ee9fa0eb718b1e5ab60be8b50965910dc7113b08

  • SSDEEP

    24576:RyrXYY8PANP5KzkQEM+obXKq8qHwCVFF/1PAQ:Ec4KzkQ+88qHxVFF/

  Score

  10^/10

  redlinedarsgromdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1