Extracted

• • Target

    7a86c899903d0a6dc4d85a577434c6db.exe

  • Size

    738KB

  • MD5

    7a86c899903d0a6dc4d85a577434c6db

  • SHA1

    101534da15517334cd02368e0282aef11d368a7e

  • SHA256

    202e690447812603792d0a7bebc2657f724623bbbc418e35805fdbc975397120

  • SHA512

    8e0cb4f764c37bc0846c193931790036b2cfb9928d34fccb69be7152ee89cdee2ab2642091be31c15c66d7fdd2d9e45c5525774022fb1052512972b04fc66b7c

  • SSDEEP

    12288:4MrHy90+FrUG3YB60FXccGjC3AM1DuWvk6V/2MNY2S0S0obzeG15Mo3DQCotd71V:fyLALIFcRW58VS0KbzLPzQCyci

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2