Extracted

Extracted

• • Target

    baeff3e6fdd93bbf488c9ef19b898a8097b4f50bd95018ec7bb1dc8721e86d95

  • Size

    1.2MB

  • MD5

    fc9cf8d6a035a8994d630d791d9afc37

  • SHA1

    c5a5a58309cbca7b46ce9b507fc30a60a823048a

  • SHA256

    baeff3e6fdd93bbf488c9ef19b898a8097b4f50bd95018ec7bb1dc8721e86d95

  • SHA512

    3df3f69895d0754546cec220be05091e88d20b6bf4b7d38fcedd76102290ce48000a3523bbadb54250eb3bfe45a0fb447321ea1e4b47aec9b44e743c19337bca

  • SSDEEP

    24576:iy03MUficJ9abkEE7U3EP8CQ4b7MO6XJdHMzEhN2GdWLd:JH7KYJE7UUEC9cJdsIT3WL

  Score

  10^/10

  redlinedurovrouchdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1