Extracted

Extracted

• • Target

    e30a016210433b836b6815dfa04edc0888a8e4d8e7b3fc7a188e6a9595142759

  • Size

    530KB

  • MD5

    1edb4aeb8acfc760bae0cb353acf9bd5

  • SHA1

    9b4d218fe4ae1b4deac54c8677095689747791eb

  • SHA256

    e30a016210433b836b6815dfa04edc0888a8e4d8e7b3fc7a188e6a9595142759

  • SHA512

    e3ee806b7fb85ee824bbcac48aadd7607a64e95a8382f82f22f3059ea0644fe4db8806900bc9945ec0039d86863a259b61ea3ea93884852fc473aeccae43391b

  • SSDEEP

    12288:uMrVy90iGEycz9Y0qOuwsqOCWsRDomLFYWeLoE2Ql+yoI:jy2Elzu0VICtZomx2uyfp

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1