Extracted

Extracted

Extracted

• • Target

    60bd4d2214fbc23ce9153b0319e0c18f963d564286a19141f8a2ab6b37e55b86

  • Size

    992KB

  • MD5

    924685fdd2b31acb4251590b9c84cf41

  • SHA1

    4d5393a96c9fd3463a59b127cee240412bba9460

  • SHA256

    60bd4d2214fbc23ce9153b0319e0c18f963d564286a19141f8a2ab6b37e55b86

  • SHA512

    76b9697ff372310d9db7d93ee5a4afd8b109174261ad8363f868f1ae1f125293d5b2be89a18d7d44772dd17d4c974ec4ef9b5ce852cc99fd14e360d5b70467ae

  • SSDEEP

    24576:HyPm2miRPuB5EDxnX6gwis50M57nGtZ/b3Q:S+BikL0EIb3

  Score

  10^/10

  redlinedubkanockrumadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1