Extracted

Extracted

• • Target

    cbf862458441bd534acbaf24e25e76e465eeb4af4b4ab45843231b2255a7cf3c

  • Size

    526KB

  • MD5

    9c6a904813df7d1e79eab081f42d822e

  • SHA1

    e8fbc26ab96df61cbebe745a5d94795740c925ce

  • SHA256

    cbf862458441bd534acbaf24e25e76e465eeb4af4b4ab45843231b2255a7cf3c

  • SHA512

    35cb296a39331a55f976049189bb27b5039d36e2da6cff142c63a37e27557138f4569e894700fa4100b452d1570a2b8d84d2ec2d029908e60751010b4974490b

  • SSDEEP

    12288:sMrny90RamUQy0NHE5wmMeakuU91zhYeGbopKiBy:zyHpgNHEqmMTkrzGRbWxy

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1