Extracted

Extracted

• • Target

    e3e5ca7a29b2ed91d6dc9c2223e7dc08eb1ad25fa495368b12cbb20c8043afcd

  • Size

    526KB

  • MD5

    148c782f7fa1b16a09bd9cc8d23509d3

  • SHA1

    127c219ac2f7d6f8c7cdf3d3e18db43da3f22303

  • SHA256

    e3e5ca7a29b2ed91d6dc9c2223e7dc08eb1ad25fa495368b12cbb20c8043afcd

  • SHA512

    ba15f92d832af9c7121ac35f786c5374965701755879c3fadf36bac524eb6e821ff70c1a76a28cbadccd90da60322e57b45353392c5909a6a3335049f3cd7fbf

  • SSDEEP

    12288:vMrGy90/9Tgjy7c1SPVtBMeRu6/omr+6b6o/:ZyuMyQqhnom646o/

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1