Extracted

• • Target

    1455c02724f01860990caf7a8253ad58b32ad2b9ffb955c36205fc82473e222d

  • Size

    585KB

  • MD5

    662bf19ee4d2d7012a4a992e481de2e0

  • SHA1

    af801f5aba409e74a33df5d25411c4007ee7ca41

  • SHA256

    1455c02724f01860990caf7a8253ad58b32ad2b9ffb955c36205fc82473e222d

  • SHA512

    622e93a3321e0299b2d97163d31c5bddba42f442a2e8fc54d0d60ebf8c9195e3079e0e9293e2738d2992e2a2884b7f50c2e4ed3bd3434c980ba309430f203aef

  • SSDEEP

    12288:QMrYy90QUTjhPtkCU+XWOBZhUTnBkmpCNI36YNWR:YylUTJXdBiWmpCNI36Ek

  Score

  10^/10

  redlinedizadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1