Extracted

Extracted

• • Target

    e24aa91844f161bd3a3826f56e165d70ecbe35529d0b74aa73051339997f8669

  • Size

    666KB

  • MD5

    711606d4a9d81857c2e615c46601133b

  • SHA1

    c9a43563db935b7e164268dae14d0cba11964562

  • SHA256

    e24aa91844f161bd3a3826f56e165d70ecbe35529d0b74aa73051339997f8669

  • SHA512

    a3941d5e5655adcdfdcb7763e9d5b60b20f27e65c65c8bd43bb22edd2b0a827e38c7a574407b84f2ca145c68e9fe321abc852d6f43c71ca3fc1d12a6cb3049c4

  • SSDEEP

    12288:aMriy90GjSpas3RTp8lfLXdGr5k47w6CmR3X6NNP1B3qZPISYdG+q93:Qy5jSpas3yf7dGr5k6Z3wXB3qZJZ93

  Score

  10^/10

  redlinefchanruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1