Extracted

• • Target

    bc65bc1ae42f0a6c481afa141a204157eb9d5aff24834dfbeccf050984548f17

  • Size

    478KB

  • MD5

    fa2b97f626174c4af4482c5f8cb1ad6a

  • SHA1

    5b03722b85c3ed586ed7f5cc665b4eaccbc339b6

  • SHA256

    bc65bc1ae42f0a6c481afa141a204157eb9d5aff24834dfbeccf050984548f17

  • SHA512

    fe5d7cf7a9563e95e2f6eaf6eb5de072a9859590ab0a9ee5af107f8992f2b062e4538d3f43c907e45dd23b0ccbbbd27e05571f022f94ec17a5e7874613a79f90

  • SSDEEP

    12288:wMrQy90JcQDNVyzY05c1u31dTUcLW7ufq3Bj:wyEq7XbT3W7ufwR

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1