Extracted

• • Target

    ed9b8ef1b181533f5aeee18bc86039cd4f80840bbac9b15eab46bbb5f205abcc

  • Size

    556KB

  • MD5

    5aee9e6fb9180410587816989714f8cd

  • SHA1

    d651ee613657f05684240f3d46d7300e405c622a

  • SHA256

    ed9b8ef1b181533f5aeee18bc86039cd4f80840bbac9b15eab46bbb5f205abcc

  • SHA512

    a80ddcd82b2b2a04d059054f539726ff18d6307c138b0c546a860e7c5956c778bfdd20f82709f61235542cd1bf8138ac6837c20ba61f9b20f08bcc6826f228ad

  • SSDEEP

    12288:aMrZy903bm+R0st974iU0Quzzqi4WohFIE4tBRXUuN:LyYi2ft9VUozzoWozIEKBRpN

  Score

  10^/10

  redlinedubkadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1