Extracted

• • Target
    01593299.exe
  • Size 580KB
  • SHA256 bfdf2ff72fc38bd7cd4a31f63c9303428eddf931dd83f73e9ae35a29f1510027
  • MD5 a85b45743d54e7f1a0f281c4a446c5f1
  • SHA1 5248f066566c11dba274fe13f4bcee60f110074f
  • SHA512 d0e44311aa97bc83f352e9525fff1468ec67e3d461d8a5fcdc3f5206f955b320e6367a56974ee51509e9242bd7530041490435389174921ac6dd47fcde164253
  • SSDEEP 12288:vMr5y90YssQIUeSoEuZrHc3YNpqBQKtZj1tIhNEslLiGeL/A9:Cy5HfSVYvq3jM5iv/A9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2