Extracted

• • Target
    d07b224e4e69d149bbd728bcbb58112a7aae7bfee70bf.exe
  • Size 525KB
  • SHA256 d07b224e4e69d149bbd728bcbb58112a7aae7bfee70bfc6fbaa054a3d25772e2
  • MD5 09abeae13117e8f6b9da53cf23d96bcc
  • SHA1 a2b7d12952b18f38c815d9f77070319b366ac9e1
  • SHA512 4f1a4b7bbbd815042ed5a618a7dab942fa12c189ae871e1cba25ec86fd673defa9e14626774a50085d6c46514cef4da8ac42b65f576bd35d3c4e3eeb6b1c7073
  • SSDEEP 12288:0KDuatQ2PBsAzjQs0DzM7pEKwk+0XldQxB5dlT:0KDua7frMzM7pEKwk3VdQxB5fT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineandreevasioninfostealerpersistencetrojandiscovery

  • Detects Healer an antivirus disabler dropper

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2