Extracted

Extracted

• • Target

    7d9c8351aaac93a360d70829e9d7200326be20f0f3a96284b218d627f7077004

  • Size

    526KB

  • MD5

    122775501867696fa4523c46f9544966

  • SHA1

    3608960a58e7f9b421bbb2e0f88c7219a93ce854

  • SHA256

    7d9c8351aaac93a360d70829e9d7200326be20f0f3a96284b218d627f7077004

  • SHA512

    9cc5fedc2b62ebc60500d515c13ac4910e6ba65940d4ef7dd83502809964ef45f5ad4b28cfde3765310845d593debb33dc0300dc7381a735adfb367f7bd5d5fe

  • SSDEEP

    12288:XMrjy90ISTsQfLfj/wXFle8u1a1C6hauh:IylSYQfLbI1A89Fn

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1