Extracted

• • Target

    cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2

  • Size

    628KB

  • MD5

    0e365d81ba1fc6b36873aec3e28b8055

  • SHA1

    a7973409cd766b6b1de27d310ef4e6c5666c3d47

  • SHA256

    cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2

  • SHA512

    bbddf3de494ab1866796522e99eaa145723cb297c7bc102e6d2f9092002e30ef3dd7fb513d003dfc08f34b4ab617a4470c915fa0a13f1c868e3bff320467d2a5

  • SSDEEP

    12288:nMrvy90AOdMaQ3lXrFf4Mm5J3IVqSqCxB6kbCR39O5f/LNpHN+CDij:0yKQ3xx83Mvqo81wRP+CDij

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1