Extracted

• • Target

    8390ab54bf5d4136fbd8e8da093ccf2d69f5cd5dceb7e98cf434adca9e31da4c

  • Size

    769KB

  • MD5

    bb5dcecf3eef2a9870b27cb051650722

  • SHA1

    ceb467319a16a70227e06365be43402aa00e9bb0

  • SHA256

    8390ab54bf5d4136fbd8e8da093ccf2d69f5cd5dceb7e98cf434adca9e31da4c

  • SHA512

    3b7042c99df82a26be43a6694ef5f7ac8b03c61fdef9774f2736afd82eac8dd94aa57b0a837cef6aaf7757455a66e77aed4dd3a1e211349b8f43504d54cb9dce

  • SSDEEP

    12288:+Mrly907fo/k7dit0s1xllWyGjwPkKK9Ot7aao9YwrTSiT6nqlvqmOa:jyWo/k7RsnfvTt7aaoDrVT6qhqmD

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1