Extracted

Extracted

• • Target

    5225eefbe6813188966a29b48e632328c4ad3a91e3ad507b44cd5d643afb493d

  • Size

    1.2MB

  • MD5

    a2cdc01207bd384c0ec033348e9194b0

  • SHA1

    4bd02e58a1e8442771d9b5b28e89effdfe6c3e8e

  • SHA256

    5225eefbe6813188966a29b48e632328c4ad3a91e3ad507b44cd5d643afb493d

  • SHA512

    7e1a72b2cca0dca36e2e3d5a49d8e46a2e0277852dea32299e5421d1ac3328303c552d1f7f5d323334186cac228e681db995db686b765e3b87f382a826d5a914

  • SSDEEP

    24576:Iy7T6h1k+6ZM6t35YVMcGaAg5znLFskbqDI771LEb7fQZh:Pm1x6yO3a9nLFsjDSN87Y

  Score

  10^/10

  redlinedurovrouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1