Extracted

Extracted

• • Target

    9241d02f053e21a404add0b1e6edf486.exe

  • Size

    535KB

  • MD5

    9241d02f053e21a404add0b1e6edf486

  • SHA1

    30b52eec6842382427d5667f0daf6a87edd9b4a3

  • SHA256

    14189c6cb21e6321c2c2764e53a98db537326d15cbc6513918146fcf256399a2

  • SHA512

    64becef3eecb593dc5a894661755fdf1465c2e9d8643da9956e6ef04fa62e7ab8ca1b6a98a0661c56afa8ac254846d09e3146df5509b571e6360396803202f9e

  • SSDEEP

    12288:ZMrxy90ARsmKG0lD5pW0XZmca6kRkcv5HGoKckk6d7QQAM:8yfHelD5dXsca6kRP5H35kk07QQAM

  Score

  10^/10

  redlinedubkarumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2