Extracted

Extracted

• • Target

    57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43

  • Size

    555KB

  • MD5

    e5384d2cb4f371feac94919c996ca6da

  • SHA1

    5e9d085bab7f60b2f3abdd42d52ba30cbcff461a

  • SHA256

    57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43

  • SHA512

    8ee9a161e1ee52fea641bcd7355f622f217c0b41175b2e48052bdb4dc9938536fb0e65e7a8456ab7bf5775bce3b8c48da942bc4dadb3207878ac4e9c516dd783

  • SSDEEP

    12288:GMroy90bX8bUVuPtkKHtAL/81sHGsdrsg+INUSF+x9TrC5:Gy+VotkStAA1s9F+5SITu5

  Score

  10^/10

  redlinefchanruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1