Extracted

Extracted

• • Target

    822ceb9326edb7eeb8a958655039fa5cf00dc14a78bdbf5e055819082287524e

  • Size

    527KB

  • MD5

    22bccfcc78b0ece72ca04f2504008cb7

  • SHA1

    fe684bfb328c254f4a43e25d1c98464544158627

  • SHA256

    822ceb9326edb7eeb8a958655039fa5cf00dc14a78bdbf5e055819082287524e

  • SHA512

    4a3a0f624dd87a06eb5dfc925feeb2e6e272b96b204293769b1a9161a54f5c77fb82a512bdcb4fe5ee0f93781f5ecaa5ec70d373130dbecfd49f966d938f3756

  • SSDEEP

    12288:yMrYy90X/KViU2Hsjtow8uaa1g75Lz1qmO2:qya/rMjtj88i/46

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1