Extracted

Extracted

• • Target

    9d0d12052e946abb14f33e9e8ff829d3bf9ec9a7dd81b8642cd125c546176cbc

  • Size

    526KB

  • MD5

    b38f27187d029c14531b21f62125d8ab

  • SHA1

    2ad04c23698460fa4b2e3dcc103e5f7eb025c65d

  • SHA256

    9d0d12052e946abb14f33e9e8ff829d3bf9ec9a7dd81b8642cd125c546176cbc

  • SHA512

    e43c83eb0b30741b5d1e1c096c2c62cbf1f866638d5784b96f508734a8466d7ff7d3d27d847ac0642a051d96ec37fe3ced13ccc64b4fe0e8da336ac670e10a17

  • SSDEEP

    12288:dMrty90EMm26Pl3ly4KnQTpXOruCR1NKknfd68t7THWAXR:4yhMk9wpnQVerFNRl6oWaR

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1