Extracted

• • Target

    ba55bf036976b70686ab2108fd4ca3d7cc0dc6cd0f4f0ae3b091149bde946c3e

  • Size

    819KB

  • MD5

    1b537338d1b1437f67cb0d4e8d579c97

  • SHA1

    0348d6cfac69cee1ea0d5c21f78e2fbc86b1b66f

  • SHA256

    ba55bf036976b70686ab2108fd4ca3d7cc0dc6cd0f4f0ae3b091149bde946c3e

  • SHA512

    99692d279a20e5a2f04bc0325aa36847bd534353b94922b48c688a415a76c8ce4a38244a223a38ed13d68be60d60e7dc1d4538ea31e3da27184d374216885122

  • SSDEEP

    12288:eMrXy902dQLKa1z9Ck7tfD0dQt+qTuZd6mdosr8Fkgn/O3ebDWVjx0HZN5pOYv6C:pyvQLKa1sk7t0dQmd6wyuyW30/OOz

  Score

  10^/10

  redlinedubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1