Extracted

• • Target

    abefd9014aa30843b180c84db652d9fc229d41703b580e5fb0dd6c0a35abb2e7

  • Size

    479KB

  • MD5

    debd2e71354563bb0efd113fc439c51f

  • SHA1

    3e1bace9df783acb2ba417483d343a032d67256b

  • SHA256

    abefd9014aa30843b180c84db652d9fc229d41703b580e5fb0dd6c0a35abb2e7

  • SHA512

    528d69e9c75079a385894e5141b32dc5b34d200ad4dd0850839dc92b0542917c783fe3e124a3e798fe37717b48cd15a94fd473e5f75fde82eefdbc1804219a2d

  • SSDEEP

    12288:rMrMy90drZVqZb+BXZpbKxKxUJIMi7gX:ny6ZKUZpexKoYy

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1