Extracted

• • Target

    36eaf80480a6d7de76b35a999a58d561b4e138ef3671625794b5155e01e6cb18

  • Size

    479KB

  • MD5

    0a826a8adaf49af3d4401cb6e59b8d9b

  • SHA1

    9078d562b7bf6ba3fab480c32923490a06804cdc

  • SHA256

    36eaf80480a6d7de76b35a999a58d561b4e138ef3671625794b5155e01e6cb18

  • SHA512

    c015ecf0875a461a6ca9406ed16c850d7ba06d9e8965987cbca5d1077fb440269e57b04932d6d731dc9aa896e970bb4020678df4c61c6e8c61d7d96a0a9dc431

  • SSDEEP

    12288:ZMr8y90UZLPzB/MSicZv432ANLWfGRm54vqQ5n/14mei+:hy3ZLPzB/EcZQrW/gL5ntk

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1