Extracted

Extracted

• • Target

    1cd12cd722cf5b15ed8632578d3ca54da915c26a48a581f59cbe79b3882985e9

  • Size

    530KB

  • MD5

    28151b8b7b7243818bb62d6e0eaeab1b

  • SHA1

    c6fedac52bef3555dedd0fe54a412fd4257e1c13

  • SHA256

    1cd12cd722cf5b15ed8632578d3ca54da915c26a48a581f59cbe79b3882985e9

  • SHA512

    95f17bf5056d58ceaadeb67e2a50cf7d9107fa0bdc7973e8252b05d15598545e997d71bd96f561ed2f2d0a863ac3d5d9dabd285910dff7a46d4764396ebbe3f7

  • SSDEEP

    12288:IMr5y90cVwfLtnKSnrWTffitxWYoDomXFxleDegykRb8NfxQ54NskB:ByYfLt3WTXGxNsom1Rk0Q2akB

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1