Extracted

• • Target

    83c9c862f931df87000fe3fa9e2d37a52f670633af2123a91a29eca2518887b7

  • Size

    479KB

  • MD5

    eca6d1405c878c3553aa44a26aea4292

  • SHA1

    1396302b48ef296f9ce6007626822b671dad3d95

  • SHA256

    83c9c862f931df87000fe3fa9e2d37a52f670633af2123a91a29eca2518887b7

  • SHA512

    6b833ce55bf00badb78be21247b4688b08ae7f601c95599794260da54c904490e3bad1e187209eda9b8eb8c4f11e076cfeeb849600c9a9525b2767b7e4e043a5

  • SSDEEP

    12288:mMrMy905NoghqmsRtENh4cqPvTrpdVj7WDuDKY:Gy2LNhfqPvTrpdF7gIKY

  Score

  10^/10

  redlinedonadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1