Extracted

Extracted

• • Target

    8f819fc88d4d74afdf836beaa14368c37bc962800e08d3112225da8f2dbe6f6e

  • Size

    551KB

  • MD5

    b2372b48e4bbb5c46e15d167f658f009

  • SHA1

    292dbb47bf8a60e3d589ff66f4ad35e370997938

  • SHA256

    8f819fc88d4d74afdf836beaa14368c37bc962800e08d3112225da8f2dbe6f6e

  • SHA512

    07ecc1041dc720fa0907be2f8d2d416b28a1678e6b6dc8ebfeb90b45287e78a7a2adb124acba015d3dc5deda3c3a6daf24512d60e5cc847b04104cba16ef51e0

  • SSDEEP

    12288:rMr0y90bgGGpB407oTfDVJgmRbG3jU24dbE+aneCiMqwA5ak1:/y3GEZcXZk4dQ+yY0y

  Score

  10^/10

  redlinefubarouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1