Extracted

• • Target

    09648799.exe

  • Size

    585KB

  • MD5

    d3f4b45b3f58b633d11131989704fbc4

  • SHA1

    48dad1c9ba28fefe19be459f33ba6148ca4ea612

  • SHA256

    f4c6b3aa2ea3f34522b9d1176bb4fcc04a18c01a582f6b0d6e8b4dc63233510b

  • SHA512

    a2babcc6b5dfbf813163befff3e48da289ec7096b28961a8a5423983326e2f1b692a9acccf9cc389dbccf3777df6e6cfb101d7cd0b8233ebb549feb55c90fa2e

  • SSDEEP

    12288:eMroy90iZnCErEXNTO41f25P+yyp0ZDgD1IoY83XjvnPW/2:iy1nCEr0NOP1yp0ZDgDHXzPJ

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2