Extracted

• • Target
    file.exe
  • Size 853KB
  • SHA256 73bbf797bb1ec2758a9fa232e3c47eb3317a1718de26377bf7900dc9fac1bcba
  • MD5 40d1abb074168b91814fbf11c5b6172f
  • SHA1 b1c98683494c214a2c527781a3c267a688244a23
  • SHA512 f9d2f205239dfefba1ea998c8770eb32119457f1b1c53c581284e50ce8327db8484841a4e6bf11d984c2c4277dd05a15e8f516aecd769e0e1e4fff8e8a4378b0
  • SSDEEP 24576:1yA8uorm7jX+ww5gboGgFssAoid60EQEtLKdm9B1Kl:QA8uUGOwwOboGS1F0EdLKu1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2