Extracted

• • Target

    6ac67a3a0a23e78ee90f397c6279bca452ec6701023710e48584a299a23a4aa6

  • Size

    479KB

  • MD5

    e4c461388971cedbe27bb080ea80076f

  • SHA1

    65f5c45f7ec973b7a8838f7648588ed16628e40f

  • SHA256

    6ac67a3a0a23e78ee90f397c6279bca452ec6701023710e48584a299a23a4aa6

  • SHA512

    565804afdd1d1e554a8f3c5e58d80be566ace77078dd11f6c9f7bbf5cd4fa7302b7626cf57f1ab4c38697ed6460b0917e8731daf08260f3aed6a89b31bf1ce4e

  • SSDEEP

    6144:K8y+bnr+dp0yN90QECxnLeWEFhFZYpVFJCGEuWfnTe1mxMhRtib1K4SXRzB9etgG:cMrxy90ExnMakuWyiMIxbANPAMCdSu

  Score

  10^/10

  redlinedoumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1