Extracted

• • Target
    cdbe4a50e61842ef2ffc730ece27ba97.exe
  • Size 513KB
  • SHA256 7e4db9b283ebbe83f34e2c1a036067bbfb322b3287bff43a73bb022d4c1cbef6
  • MD5 cdbe4a50e61842ef2ffc730ece27ba97
  • SHA1 8e766c207f633a4463bdf12078fcf0a6a18294d9
  • SHA512 027c85de6992accf5d105ccdf8ee9a81210e339eba2a3197212f34210de0169698e5458aaff9965dc96a4643bf4f5fdec0fcd854832fea513b11e1fe41d553b1
  • SSDEEP 12288:ykuHpDQ2PBs4sU9RbfCSjjt3X/j5d4v+53jQb:ykuHpF9D1jZbN2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineandrediscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2