Extracted

Extracted

• • Target

    891553154c7ce33bd5c6476a55cc0c98cd02d4a6547e9966a6b0c4a48b05a4db

  • Size

    668KB

  • MD5

    26e960fc93e86eb12294e2b6e1fea9c4

  • SHA1

    395a8a3c91f4e57eeb3698c45bc107b73151319e

  • SHA256

    891553154c7ce33bd5c6476a55cc0c98cd02d4a6547e9966a6b0c4a48b05a4db

  • SHA512

    463d90e49b97dce87dd9b9b0374449d3dccbe1446f0c59eb0d16a3ed389b05885e8038580092275c6e98b8aaffec8cff55ce79ad8d4651b5d2205fdbcd78a10c

  • SSDEEP

    12288:6Mr8y90y9+V8k3uDwI7kH+Z9Efxjf4u/fqKTn4XAFwSNFrf9K4EP4CJzhoFCq:+yr9+GdDwDH+Z9EFfDfMXCwSNF79Kn9E

  Score

  10^/10

  redlineflursruzhpediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1