Extracted

• • Target

    e8ff7b619e81e251e940ad9e1e0452dca75cb33072b1e561121b3478ccc414c2

  • Size

    479KB

  • MD5

    e8918528d7464a05d3287fd13375a39e

  • SHA1

    1cf918ffc5a048c2be24589f5e0636402bad5e10

  • SHA256

    e8ff7b619e81e251e940ad9e1e0452dca75cb33072b1e561121b3478ccc414c2

  • SHA512

    5d3c2d556a39a5e0a60786c55d8ecdba9ac72f334bd681e4fc6a39a6d3161acdbd3dc733191a13d5885b8b60e9320b2e2e31debb309b92ed23f7ef42508d691c

  • SSDEEP

    12288:SMrQy90eJ6XscNU5cmez/qeArjHz27ClLA49w:GyUXBNU5k2nvaWlLXy

  Score

  10^/10

  redlineditrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1