Extracted

Extracted

• • Target

    dde64f7669c607d355386f46886a0bdf4b2af337355ba201121f8433dfb8a780

  • Size

    538KB

  • MD5

    9e3473013bb526f5e1d78fd99cdf0b08

  • SHA1

    394eff0c8fadd58e9678cbba4bc263e38bf86469

  • SHA256

    dde64f7669c607d355386f46886a0bdf4b2af337355ba201121f8433dfb8a780

  • SHA512

    8593b60d6b3ab0b29636ee6625df7c80e7f6b1a07e1f9dcda31790d4e54f9da80bc0738e03a9a9b146f6392c80c7d37b1b2ed9c5e9b8a4f4854f9294100a7f93

  • SSDEEP

    12288:4MrLy90u44oCQmIcpBCdo9PZ73z22yM5uNAe6z3at6b7rOg:Dyj442cb4ob7+wz306b2g

  Score

  10^/10

  redlinefchanruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1