Extracted

• • Target

    22f900f9ca5d8b2cfd5c378a7f071a2192f281840dba54d9ff51037fc4567a62

  • Size

    478KB

  • MD5

    3d0562d55247eeb9a7d0ccc86b8a902a

  • SHA1

    fbfea7de15c99de398f034e56b76748bf6019b6d

  • SHA256

    22f900f9ca5d8b2cfd5c378a7f071a2192f281840dba54d9ff51037fc4567a62

  • SHA512

    bc7835c7797fb9f3c59119b706525af514685de6004e49add12c165c6161934de6e5c1aee35284dc4d4c29c5a9effa9be6e72d34dc3331e5ba65273d0ee99cbe

  • SSDEEP

    12288:dMrsy90uBwxEKox06x1D4VtKqZ3wCSsPN1WZeP:Fy9uxEBNx1D4hBlFSeP

  Score

  10^/10

  redlinedivandiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1