Extracted

Extracted

• • Target

    4b34dabbaf317a02244f950437bd867a8cfd87d2fac8bb98a18fcc224f83a60f

  • Size

    538KB

  • MD5

    9daeaa762364b0e18d7d539cf41c53be

  • SHA1

    b355702c4867cda2c0c96fe6da4cbb7ea443a258

  • SHA256

    4b34dabbaf317a02244f950437bd867a8cfd87d2fac8bb98a18fcc224f83a60f

  • SHA512

    cab521ea7c95f787c5b795250ad2dd6e95cfc428559a68973526d5be5943876d65360c595079f396b329e9e2c3480b5b41f723f64dda1bf5c48f2f9d7460806b

  • SSDEEP

    12288:uMrqy90HoF5yDH8Kt5Py6CYXghwMNFruXKPEJMnPVB2:Eyi4yDcKxFXOwMNFyXKXnNw

  Score

  10^/10

  redlinefchanruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1