Extracted

• • Target

    2d4d3eba8eaeb76e915edc3a5a235fca8b21355a2e96e453d1dd125716580eae

  • Size

    1.3MB

  • MD5

    588a182632a0a1a97bae6f40d04e5b62

  • SHA1

    33a20de915501632b4bf03b158126888a9b1cc5f

  • SHA256

    2d4d3eba8eaeb76e915edc3a5a235fca8b21355a2e96e453d1dd125716580eae

  • SHA512

    f7059754461481731ec840daab1c4cbea761bbbac109c0e4c5deb910882ce779895587e13e2125f36064f937964275b175e1d8e87d9827e0dfe66ee45883cdef

  • SSDEEP

    24576:jyBAw6kfakd7r1ndK3Xzu9oWDjL1iUSFFiaXlwexLMH5L4zVMzkiOBBFVO:2BA0fac1ndYzu9PjL1iVFoaXlw6+L4ZD

  Score

  10^/10

  redlinerouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1