Extracted

Extracted

• • Target

    447619bb127117be25eb2d36d2279ff97a45eadcc874868ee74813408e7da258

  • Size

    1.0MB

  • MD5

    4da35d1cbd9fc920ac52bc149d7fac15

  • SHA1

    73220d4184a9c1e357c3cd251c5df08b23a3bca9

  • SHA256

    447619bb127117be25eb2d36d2279ff97a45eadcc874868ee74813408e7da258

  • SHA512

    9d16db8d64f65a3919dea4f8f654aac324f3f888af4d127f372bc7ac2982913ec504b2218f894d2560da43a4e260ab43af65da4cb279e03e4bc34cb19c70d614

  • SSDEEP

    24576:HyQuTkgU3jdwJeIr9wvqqq/GEfnw2lVAIHN+urI21oSTgNIA:SmPdwJeIr9wGeE0It++ASv

  Score

  10^/10

  redlinebrainlusadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1