Extracted

Extracted

• • Target

    22ebaf513b345661a0a27544b4c6db66a4783b14daace642a838ea0313819816

  • Size

    1.5MB

  • MD5

    338f1c2cdd191363b0565ef85f3589a0

  • SHA1

    b14010eee2536e503f54563cc3baa306b812bb4f

  • SHA256

    22ebaf513b345661a0a27544b4c6db66a4783b14daace642a838ea0313819816

  • SHA512

    116cd289c0bcd6fc290dc850d7771f60b94e13a9b436e9f2d85b4deee980b354677d3ee914fa2711256d081e76eb491f3686dd16ece9c91a4c0c56bd7c5aafce

  • SSDEEP

    24576:Qy+BaI408xwuGlgiVe58msLmKEjONKJzi0HqOy:XNI+qHFVeALmKEjONKJz5

  Score

  10^/10

  redlineboommaskdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2