Extracted

Extracted

• • Target

    68403e6036bfccca2b532e81514d14f5ffad7cb56bc3beb01518c2df74181655

  • Size

    725KB

  • MD5

    ce7e7064a4e5e0f4b3ccacac9cf917fc

  • SHA1

    4324a8540275110241518cc7353fe7f8b6bb61a4

  • SHA256

    68403e6036bfccca2b532e81514d14f5ffad7cb56bc3beb01518c2df74181655

  • SHA512

    a62253b763cc8c0fc3f70e350aa97e73fd662c2cb2496d3e0d67ede2ea75839d6b6383744e3ad8e6d4064121e668a8b5a3904ff862e85fd3a5c6144168c844ff

  • SSDEEP

    12288:HMrQy90l09Mjx+LjtNwPaauJMtC3uFrh65mN0sX6QRWHqLRhnMPbbFXc:jysv+LZqNC3u6hsX6Q4KLRFgc

  Score

  10^/10

  redlinefudmishadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1