Extracted

Extracted

• • Target

    33da35d3cdaaaa4a75a7f764191a12babef97a516764cae883db50e506a3b0c6

  • Size

    1.1MB

  • MD5

    12cd3366a14a97dc6f54aee3e4e34c08

  • SHA1

    76eb67d056e09031774054b37b0407c75b611fa9

  • SHA256

    33da35d3cdaaaa4a75a7f764191a12babef97a516764cae883db50e506a3b0c6

  • SHA512

    07f467e80447b9a6573612a9ac2e01a35f7bccf9e93409db16129f7e058a1df45e002146fec9929bfcc3cfcea778deb09623067743fc0e141a8022c26cbe6a06

  • SSDEEP

    24576:mybjDC2yw/AfdXzkdul/togzNS4XYf40AHIw6:1LCR22I4b04T0A

  Score

  10^/10

  redlinedurovrouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1