Extracted

Extracted

• • Target

    311dd0813811cc4fdda68ec17f64e7b2935427a1c8cd98832622659bb6855f67

  • Size

    560KB

  • MD5

    8768adcbd96198129dc4f49e8cde9514

  • SHA1

    0fb4c61eec53055dba98c84cee1720ccf84c3c83

  • SHA256

    311dd0813811cc4fdda68ec17f64e7b2935427a1c8cd98832622659bb6855f67

  • SHA512

    68d7806639fe01539670c13dbb7b667045c710c0ace139d590837c0e9ba929b89b1b1aa88cedd21cb7cb715d01e767896da63d61fecf747368b37a85284830f2

  • SSDEEP

    12288:KMrty906c9eCrV5ZXd9gj2618pyt7T6D4y9bx6CUKLlL0juB:ryxLgV3tB618At7T6DL9bx6QlL0juB

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1