Extracted

• • Target
    30ab384ff7528abb56b2bc2172324ee7.exe
  • Size 584KB
  • SHA256 be5823c29efaa6892b51a79052ffe4dec799fba75242ffa3427f020712fe0115
  • MD5 30ab384ff7528abb56b2bc2172324ee7
  • SHA1 1f59cd7b66fa481aae17dcd646acb4f2de91a80f
  • SHA512 62663aa7528727f6ddeb2bc414f443490b6052437f3989036dbce3b63c6a1c7c23cf5f1fc22560232f118415a2309ea692621a98b335483a9f979d9c08d864f6
  • SSDEEP 12288:XMr2y90tnAKgqF8f5jX9qElOkxNUAS+x9qTf5FmZ7:RyWLgJNXICNV96f5M7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2