Extracted

• • Target
    02379999.exe
  • Size 580KB
  • SHA256 e289930a7b6af4628ed931cc6ba3f31503482f050a4e6243767cb953f1a0fdf9
  • MD5 f0420c2012ae95922532e9849dfdafa5
  • SHA1 e4aaa0211c37b7cc79af2167a3a9ebee9b52cd76
  • SHA512 151bfdfa705f73ce4114cd00d8aeee904a5a535339c5dd729baeca93eaa96e3de7d7be8a214bf48923b1d75d78def564232a4f95e610da3ccfb996af70f13666
  • SSDEEP 12288:6Mrqy90cMxIzwWnTcav2bpmUyB/tYLxMz44/tE5yqelWLxLP+PIPB30:syL8IUgczp/yBlY6z44W5yqelWLxLPEt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2