Extracted

• • Target

    1d6943ccffb8c88ca15febaa2f921e62ef863c5045f2dfe504b56305f1ae8b1a

  • Size

    580KB

  • MD5

    b404403e77045a51e60ceddfac6856cc

  • SHA1

    e10a1fe75e82ed9cae6f70d74c1e069cd365f41e

  • SHA256

    1d6943ccffb8c88ca15febaa2f921e62ef863c5045f2dfe504b56305f1ae8b1a

  • SHA512

    d35793206945fe233e0db86ef04136380f882d993c3df06faec370425e7bc34086791616d21affbbb8eb1733b12deed6a4fa2a58d515b030aede5f7db63cc8ba

  • SSDEEP

    12288:9MrIy90LCnoQeFreyjQGGCOzJ9K6w/sJ2iM4Ux2ZH3E:xyKfLevG1qMj/wM4UEJU

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1