Extracted

Extracted

• • Target

    c7ed308ad426a12e88150a6a680eb8de202e58760fbeb5b0ea69d1877de7e060

  • Size

    786KB

  • MD5

    8f91b10adce485d0133d3fe5643bcc72

  • SHA1

    836d2a3a43fa148c934ca12eb38ad1a1aaa6fd99

  • SHA256

    c7ed308ad426a12e88150a6a680eb8de202e58760fbeb5b0ea69d1877de7e060

  • SHA512

    6b7df7d14b9fad5701500fc8d6aa420311c54c015f43b6a87d719af722f9c7732130945d132a33edee62d1c7ae4ef98304d116ce11ac9f368bb76c826f229930

  • SSDEEP

    24576:PyVFM/tyWzDojvkSpLz2/LBcRmuV2ILf:aVFMF/zULb1Q1uV2E

  Score

  10^/10

  redlinedarsgromdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1