Extracted

Extracted

• • Target

    26fe7a088a62f1844bc514533a13becc.exe

  • Size

    549KB

  • MD5

    26fe7a088a62f1844bc514533a13becc

  • SHA1

    692aec8bc96bb013eb3cc18415bfbee5d5225e59

  • SHA256

    718eb1a15f1b7aa9d13d1beb659c5205502fa8b150be3c87406e1083c1821afb

  • SHA512

    feb78e821d358575c5f35b4d02ce98832e827a868a371a7bdf4d188f3b47b4675a8d27b8c9835a74944db768162290e7cc1fa73985b9b7ef49b1857fcaa949ec

  • SSDEEP

    12288:eMrby905t2QPlc4X5zPKB+sQqzQx0esPIkZhUQ:xyEHa8rKB+DBumQ

  Score

  10^/10

  redlinedezikmangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2