Extracted

Extracted

• • Target

    e94cc00e26cebf17242f445814bbf53e.exe

  • Size

    694KB

  • MD5

    e94cc00e26cebf17242f445814bbf53e

  • SHA1

    d4f85180d5de1261325c9a33b7af157dab44bb20

  • SHA256

    30b3952bd4f49fb1c1643e29c05af36d39ed26896c0011b48bdd16a5674cf362

  • SHA512

    50d7e579f30dea0040881cfd5f8ff9fc31dd862d82887039a03d124df457ca4ae36fecd7eb508539624b87455e395e2c03bed4e47fff3e1587767eaf6dc07dbd

  • SSDEEP

    12288:vMrQy907SCu5+9JD2mhxK2+Ptfg0wiDcZ1AjvKYiSkzLycLlhnUiRu2gz:ryu6Q9t/b+PtfgoDUAjvKYNAyOUiLgz

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2