Extracted

Extracted

• • Target

    1bf25fe75e1e72faf7191e14b1f6d2afbbcfd8c119844bd5015d90fac51648f3

  • Size

    778KB

  • MD5

    0f14f9b11c933224678665080c6438a7

  • SHA1

    ffb7ed6e8cb6d82f438ab44e4f7b88be8dd5afa5

  • SHA256

    1bf25fe75e1e72faf7191e14b1f6d2afbbcfd8c119844bd5015d90fac51648f3

  • SHA512

    44a6f2817c7274ccf96972b4e5fcbc086f4342c18220c866e2bef8598752cfd974eef4b2849fc2c5954b8749d97184667a74a6c41329b7f80653540581aac751

  • SSDEEP

    12288:TMrzy90NWwM1bXws5rDvbpN9Q8srlc2HzcPvRK03MPAOj:IylT1ss5rDzSRJzcPv13M5j

  Score

  10^/10

  redlinemaximetrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1