Extracted

• • Target

    4894d32c6778fe73ab1ae53d9214cd09bae594ffebbb3a0ee1e7d55a8ab03f09

  • Size

    738KB

  • MD5

    f44a4883efba4d22f3d23984eaafbb21

  • SHA1

    3e6e2899087f9049c85d02ac326934fb6a333f76

  • SHA256

    4894d32c6778fe73ab1ae53d9214cd09bae594ffebbb3a0ee1e7d55a8ab03f09

  • SHA512

    99bba03a4135280bd1d592311862fa42299198af130e14a7f9d7e90c06b71de1cff4f95a7427a4166a813012a0468270be9c124e0da227d2c98091246e8e36f6

  • SSDEEP

    12288:uMrzy90G5NSj/MuaWDFWwh6meL+/Izl7aQ8bnjxL8pGZIjaH/FWr7zAUt/MenPz0:lythWDQwz+EvTZVzC/fPzEpqe

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1