Extracted

• • Target
    file.exe
  • Size 584KB
  • SHA256 4b2eafaaa864645f665e47c8a81669e48cd109e828696ebbb9dfb8b4edc82be3
  • MD5 86c921db6798a284b97f489036e0bde2
  • SHA1 dd2c1b54ff6e0c4b72310ff5271d102681815607
  • SHA512 d2fd70f6d84b51e24c79417e100f1bd78d965aab3de286b5789361f12ff7ffab5a40821e1c11dd6b93086f3da3efe84189592892cb8edbb553275aef3029d4bd
  • SSDEEP 12288:pMrSy90YW1Lk9pLIx5OZAvxQpU+52QK5jQP04JRQK3uJprnaJguTZSsZm:LyW1wHIqZwaCXQ4QP04bQK3irnazZXZm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2