Extracted

• • Target
    file.exe
  • Size 580KB
  • SHA256 43437585c100c2fc9997a0b900ff974c87ecb34de67e52caebce716903ab9dca
  • MD5 c49a3d95bb31169caabc98afd195a763
  • SHA1 35c4496b38903a38c1036ce32304b82485a96d6c
  • SHA512 3632405ffe60cd8dad8290afa4ca895bdf0d22bbe8b76abe0ad4715504562b188664d4d3746dcd0bc49ebbd60b4bb3a01a8f90c867c76a3bba2ac850ad995583
  • SSDEEP 12288:rMrGy90r9ZrTHPy2Wiqcskyk4wbLDsvavh0uFhVw4:JyqrvW0skymTsvaveihn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2