Extracted

• • Target

    f4451f5a2814c1329a5feca69f6c258aef049ba6b9ec8989eead8410dc8ecb79

  • Size

    479KB

  • MD5

    7c3ec13a4cc2d0a02fd3bf943b51f8fe

  • SHA1

    4ca7ba269fe80280d77cff5dbeabca2307deec15

  • SHA256

    f4451f5a2814c1329a5feca69f6c258aef049ba6b9ec8989eead8410dc8ecb79

  • SHA512

    e90bf04bbb65b568db92c9ccbc5d89dff3420c346e9a73e386de0ed01022deacf34d69c2bebe57393b215887154cbc5e8f6e2cab0c4a6901c0c28131391abfc3

  • SSDEEP

    12288:8Mray90aiGU75c1u31BTQNzjzplUp1QXN3yWzG9TN:uyDiXXPTezHUp1aNxGVN

  Score

  10^/10

  redlinedivandiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1