Extracted

• • Target

    1f2a8b03749334014b5f69bc67976217397491f3da7cf0d288d4724d49f2f42e

  • Size

    479KB

  • MD5

    2fdbef56cfd8654a9939e14144c4d7c1

  • SHA1

    3472fb7d0ce294c12978e0a9757fdd829a999e68

  • SHA256

    1f2a8b03749334014b5f69bc67976217397491f3da7cf0d288d4724d49f2f42e

  • SHA512

    3d20ac7d50c93a89f842d98ffff43b29e10b211132609b4ca123c63f99f128c5934d4c794e20bbef8f7bac5c03d38e13717cd205f32768f34bd6dfb906234afb

  • SSDEEP

    6144:K/y+bnr+ip0yN90QEIOUeJ/W5DIl179c2HCTCCq8T5aD2C0iLfeiAASK9HInI:9MrCy90OLeJj/7S2HCT3dUwqxR

  Score

  10^/10

  redlinedonadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1