Extracted

• • Target

    bd201fcf146722968df64b5f2a5095b1989af7b08cec204418118cc9e0995c31

  • Size

    770KB

  • MD5

    bc5a215da7b4b11c86e8559248aca49f

  • SHA1

    98184ece583d792454ad1687e4a899a52cecdd3d

  • SHA256

    bd201fcf146722968df64b5f2a5095b1989af7b08cec204418118cc9e0995c31

  • SHA512

    fd6b39719fd201ef0192fdfad9be2d50697ef9e1f7c422fe281e62e8a1570c8fb8ff986a484aabf22161f74031ec56f7ce766fb95902759460e5e3d41aef7e01

  • SSDEEP

    12288:zMrdy90QdFVOj27jzKXYALC9C+2KKzOv1aaB9zIAikSikCh4EzCZBNc:Gy/dwijoY8SPv1aaBiAjcvZBNc

  Score

  10^/10

  redlinedebrodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1