Extracted

Extracted

• • Target

    df30717514db4da5abd243ba848f0b258761d04311647734af3303d1a4dd5dad

  • Size

    778KB

  • MD5

    84fdb62604986de9784d4dc014d941a5

  • SHA1

    dad09a076962286613aeb574ef4f9a2da010db77

  • SHA256

    df30717514db4da5abd243ba848f0b258761d04311647734af3303d1a4dd5dad

  • SHA512

    e2f1b32c58c3d038057f9bad41f82377f47e13b27952c5bb5e38a8d6b0905a0b2895aedfe54c388659b40cabf0ec8e5c0462baf1d248f7edaac19a4886b93eb1

  • SSDEEP

    12288:WMrIy90F4/lHWJjaRUy/AkRW5Y7GoDx7k3pXjktO+nTMv8DzAe63Qwu1:KyttRBRaY7DxIyZnTM0Yet91

  Score

  10^/10

  redlinebraindusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1