Extracted

Extracted

• • Target

    dcef3080d712d9bbb746bb5cdb7e2c7927da5e3578d13cb2e0f9f0be9c99fbcc.exe

  • Size

    532KB

  • MD5

    1dec159951f1abc187f8291376f46231

  • SHA1

    8eaf537891990be712cbe885981bac83cd86060b

  • SHA256

    dcef3080d712d9bbb746bb5cdb7e2c7927da5e3578d13cb2e0f9f0be9c99fbcc

  • SHA512

    5d0e7792a464718629981dbf260d537b3de895f62a4d94b35ace15ecd05120f5fef3eaf083e55898850634b6afe0ed82a0a2287d968ca8a422a5296c02a95e24

  • SSDEEP

    12288:BMrvy90aIlS5z+Igau7b/d28uXxsA5OJsJg:Gysu+IRunFSXF5Xm

  Score

  10^/10

  redlineformarumfadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2