Extracted

Extracted

• • Target

    1141bf777c1e17dff00f825f33760ee832f29e66bcd783320a4c0c5cdbe409d6

  • Size

    526KB

  • MD5

    5eb4ea3dab50cb3fba930569cb5ba9db

  • SHA1

    5d3e398e2a8a95143fb6361ccf53da30a104da25

  • SHA256

    1141bf777c1e17dff00f825f33760ee832f29e66bcd783320a4c0c5cdbe409d6

  • SHA512

    e7fc7edffdbcc7f91c7c73c7de816ac6b50874991fcdfa1971f01024f457fdfc97a9aacf0e2f609ab706d7926870760fc5057999579c4262ed9fdf329ed71469

  • SSDEEP

    12288:xMrRy90eV50qGjII68EWxE2JLop9juxN1FypYjMaX:0yX50qQII6jouPj8QqMaX

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1