Extracted

Extracted

• • Target

    f1e7dfd049f963c0a7c248960ee93b4bea16713beb5f554de49040b24a380f1f

  • Size

    526KB

  • MD5

    bdfa32d6ff3f8a09929cd5d2a29c9b76

  • SHA1

    dc236a94d7bf45af931439c773278b5fce43b689

  • SHA256

    f1e7dfd049f963c0a7c248960ee93b4bea16713beb5f554de49040b24a380f1f

  • SHA512

    5f552f2babb146b0e56a2a8700a0e3e9f770595f3ff8fac33aef7a1512bfdc3d9b5689745a58f8a28581eaaf55e61b25d23dd0ca159323862d942aba9fe45359

  • SSDEEP

    12288:UMrLy90bTt3sA0saZTVt9x0J/nUy4iNuoMkCyWk:Hyl/FZbc/UG/oA

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1