Extracted

Extracted

• • Target

    7b795417cc7a5314630604fe64b969ca069ececbd6a3632cd475d2b6625640ed

  • Size

    560KB

  • MD5

    3fa267f3f3278c4ccf1eb97f2b94c7e7

  • SHA1

    b51b8e6d256fe537fb5883e1c1dc428bece85369

  • SHA256

    7b795417cc7a5314630604fe64b969ca069ececbd6a3632cd475d2b6625640ed

  • SHA512

    ee3f10ebeccd4094242787ae4bdc83ff862da07bf5544c6e9208eeab0b24e2880812a2d81ffff206e971926f877de6d162759fe38f4794d11a58a69acb1053b7

  • SSDEEP

    12288:kMr0y90aIRv5VVZnMOqE2MFiVGKT/q2DUL9taEN:Qyy55Vrpr2MFiE2qv

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1