Extracted

Extracted

• • Target

    1f107f5f28ef6900b0cd9f8227cc24aa59f80135634268bea8ca0e6009a42654

  • Size

    557KB

  • MD5

    356ca93a57b4e0a44a8348c3b36834e0

  • SHA1

    3ddd6de6cdd071c123bf6c511742f8f62d392802

  • SHA256

    1f107f5f28ef6900b0cd9f8227cc24aa59f80135634268bea8ca0e6009a42654

  • SHA512

    e9056d81aabbb91b59dfdf546ffa891bb7de77b6f9a97a083fa74bdb574972c6b3d8cd7362e339706eac1a44d9b1fd549c00fb315284fb165164b7ef95b612ba

  • SSDEEP

    12288:aMr7y90LCoFM3aHCxtGUiNo+xxwsmzBqfcFtGJG2OUN4GhIJeY:9ysKB7iNpvxmzBgYGJGhUNjQx

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1