Extracted

Extracted

• • Target

    2ee3c9b9d65b0b54550371acbada5738e1e2ff3d445c3d34a782081506b62abc

  • Size

    693KB

  • MD5

    f82d5888e7207a2dcb5aea85dd77c7c1

  • SHA1

    f7a2c24953ceceed07ae66fcb5c823a9c7bc5f14

  • SHA256

    2ee3c9b9d65b0b54550371acbada5738e1e2ff3d445c3d34a782081506b62abc

  • SHA512

    a4ef8d1f7697d86fc683a9224eb0255732f50533803d7b602f63a4eb46f30ee6bfd387b388b022deb4986ad87181941caa46ae17724f0210671053a190cd748b

  • SSDEEP

    12288:AMrSy90PMg5Y4VDEUBvmOYumjZDBVBWPbH6XamOAW+x8L1O:CyXUVD3vmOxmjZ/MPbHYuk+O

  Score

  10^/10

  redlinefchanruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1