Extracted

Extracted

• • Target

    dad6844384570b6a51713e3d87b52af23d5fcceb68618e8ef47eea3ae455953d

  • Size

    550KB

  • MD5

    28ed89a05770da8f1d630f8bbd563aa6

  • SHA1

    15575377473783d771c08c3db000d539d78c2538

  • SHA256

    dad6844384570b6a51713e3d87b52af23d5fcceb68618e8ef47eea3ae455953d

  • SHA512

    dfa9c376c8ee7889aec1cfcc32872ab3694b755bb897ea84438d50a99faba8bfe5ac3427b8e0cc5a49485a534806efbe92ff873b25c0765e8e31471b4c4e2987

  • SSDEEP

    12288:yMrmy90S7eZw4gX1dwg0FOw7kny9ktcrujJgw:kyRB4690zknpZjJgw

  Score

  10^/10

  redlinefomichstekdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1