Extracted

• • Target

    1a823f0bb5de2f64d7184f40ccaebe601d670028f2ed175df25c53856344679e

  • Size

    810KB

  • MD5

    c39264b7f6d3a40d669daa482b64d0fc

  • SHA1

    acb3b2107485293127ebd1e864ea8bf61af532fb

  • SHA256

    1a823f0bb5de2f64d7184f40ccaebe601d670028f2ed175df25c53856344679e

  • SHA512

    233d414f58a1fbb023f66f5dbf4a01e27d06234a1b35acbecef19b2270a735a03987aeed24a0ad58ce41b6eb4ea7c38c3f8fe5ea36fbffd5cef148dd911ef108

  • SSDEEP

    12288:IMrXy90aBKUFtJQGnOA2SfQM7nhMy/AHWWK5T15oP3bALEieZpmx3B7LrOFFiprO:/yQUFte+bfQMzh4H6f5DEFbmLic9to

  Score

  10^/10

  redlinedubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1