Extracted

Extracted

• • Target

    77d77228ede06bdce6aa106792f7581e98279c9bbaf99d3ed017a9ea9f44c9fb

  • Size

    1.2MB

  • MD5

    6960046e30a5ff22877d7ba8756d5227

  • SHA1

    90ca0592cc3ce1154ec1a8549b2c28057bf50ab3

  • SHA256

    77d77228ede06bdce6aa106792f7581e98279c9bbaf99d3ed017a9ea9f44c9fb

  • SHA512

    37ae59f8dcc4c515f4ea3f39b9a04e92e8e6d00fa6af42b944ff248ae6acada6c5ce3ceeb60478ccc47462fd9f09a8287fa54c5fb1fe3c467ef1a72cdc5b30e5

  • SSDEEP

    24576:kyiypHF5uYqH8EIjQgnG43m1cp1frgf4ZxsUplkqZnOA82JJ40EoS84:ziyptEIjoup1zlZjplkynOAfJJ48S8

  Score

  10^/10

  redlinedurovrouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1