Extracted

Extracted

• • Target

    534e5eb78b220dea47f350eab5286ac452b896a9a3dda4816cf20c945039cc6e

  • Size

    1.1MB

  • MD5

    cc7494fc918b6816a4f9466124a67747

  • SHA1

    9b53089a061ff03a17564c1e0657f710d21a6cbc

  • SHA256

    534e5eb78b220dea47f350eab5286ac452b896a9a3dda4816cf20c945039cc6e

  • SHA512

    23979420b2eebada86f27c40f0721c96f979070f697b54e6816d22531390f765ccfc0aca3be39ca0da1d6ff2d53843759b7bbb3cad7cafbdc19d9ff0806f3f46

  • SSDEEP

    24576:9yMqV6trkmTIZJLjhDbEOaSObIGMTm/s2ixVb+ibd2p7VIktPA3Y1Pq:YMq2r5TyFDo8Gl/sZxkibdSVIGPAYZ

  Score

  10^/10

  redlinedurovrouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1