Extracted

• • Target
    file.exe
  • Size 581KB
  • SHA256 4d3c0cbd6b1452203f2ea46a335bc96fa01aa5179d8d819c43198404af8b3bf0
  • MD5 b182b6410e1ead3797d8eec3cf1bed0d
  • SHA1 4493fad7cdd82095cf755125e77294fdb6720b54
  • SHA512 2de7fe68db95680bfbe828bd0176948e6000948720cf3f8d3e751bbfe0e95c885e9af79ac40dde3f8791df5f075f7b23ee5a43c4ef85069195b4c9b35a14e99b
  • SSDEEP 12288:PMrAy90BW5muLxd9IFL28XgKDZQqSjNpFGU+:zy2+d9Ix28XgKDm/GU+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2