Extracted

Extracted

• • Target

    742588f84fe7e4981cd99e9b28961d5f9a8deb5d4749897156f2cf7539cdbe99

  • Size

    545KB

  • MD5

    66c4c3de0335db13a71abf50282e312c

  • SHA1

    6deb8dba7aac741f8a69b2891263fb222c151419

  • SHA256

    742588f84fe7e4981cd99e9b28961d5f9a8deb5d4749897156f2cf7539cdbe99

  • SHA512

    b7e7cfbc4b6a13c56f18df4699cbf6f5613e31fc271829d2685b0fdbd34151e0e8dc864541f3d79880ad591662174c2d25dda684a6ab1f3758e2d41bd33988d2

  • SSDEEP

    12288:dMrWy905qNVUyBhfBjc6gfiMfmYFXbWtPetiWKG:nyFV7fp3ehCtPdWKG

  Score

  10^/10

  redlinefomichstekdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1