Extracted

• • Target

    9d695c55aeb9bb56ec02d285c7e70d5c954aa958087fa0c9e99de1884d1addd8

  • Size

    479KB

  • MD5

    0583dfa34d3e45963bf63bc5df33b4d2

  • SHA1

    d55f6b8ed05c1f559a162d73c240f0c51a5ef6c3

  • SHA256

    9d695c55aeb9bb56ec02d285c7e70d5c954aa958087fa0c9e99de1884d1addd8

  • SHA512

    e4c29a6ff14b5c5d209af3fdaebbe0438bd85beb9d7f4cd414d25fa105216c1f24ae74a3a5e67b0b9d2d736377e017164a416f842bfc8bba814fdf73bbfea0ce

  • SSDEEP

    12288:NMruy90LtBf9jX2gjvUDuhprq2sMI2h1t0FGMwL1+gE3zY:DygXTv8uhg2z9Bs6L1+gEDY

  Score

  10^/10

  redlinedoumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1