Extracted

Extracted

• • Target

    93489b35a81454b6d2c116417d90b00b5a57f661e16c1c9e46d488762524859a

  • Size

    562KB

  • MD5

    69a53d85da2865b05bec142a1a9383c7

  • SHA1

    9ca28fe537b9a93c00b5586a2c34a8bcc3c8ea44

  • SHA256

    93489b35a81454b6d2c116417d90b00b5a57f661e16c1c9e46d488762524859a

  • SHA512

    2424e04a3d50a3f0e42ba5d73ea47553a064abbca51ab730f61ee9dc4a9775ea80139a0764d51769f1425aca60595b3430ca5aa5eebbeba2cc21e8beb1540c8b

  • SSDEEP

    12288:dMrhy90mWRBo26u+dIc3dS7W8Nv+HIi/9SQ3TZvcgUmA5C:kyjqBopu+dV3I62GHIqJTZvcgUXC

  Score

  10^/10

  redlinefabiofuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1