Extracted

• • Target

    24094074d33fc684daed707e29dcc9357bd0f69e06c4bd3cc350527da413914a

  • Size

    479KB

  • MD5

    1a29adc0c4c701ff2787eab689f3de92

  • SHA1

    350e752452c02e77036223a00e6dccce654fbecd

  • SHA256

    24094074d33fc684daed707e29dcc9357bd0f69e06c4bd3cc350527da413914a

  • SHA512

    39ffa94146673c3252da9d68c9e353b9231a78fb200a98ec6bf486915896b621d3714f044eecc1dfa6508fc665f31cad5bac75fbdf49e9529d779596c6839f1b

  • SSDEEP

    6144:KBy+bnr+Tp0yN90QEn/BYWbj2Yob2AOszDkNLDcaa14gw8k5cFchPrMSr618lnzR:fMrjy908EjLonYhu0uPW5YFBx8Zt

  Score

  10^/10

  redlinedariydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1