Extracted

Extracted

• • Target

    433d49e0aa1c64bd2dc0c49dad92e369b3f40d1bd457bf2c34a486e685888948

  • Size

    551KB

  • MD5

    9ac7963c23863db0f54d9949b9c66808

  • SHA1

    7cc280cac100ffe60ef9137b942b4647ad4ac922

  • SHA256

    433d49e0aa1c64bd2dc0c49dad92e369b3f40d1bd457bf2c34a486e685888948

  • SHA512

    8a34b3553b91057f531291b59bb6f75d674fea3f385bc38f9afa693d1aa46c8b682151931361a7b3252b01abc69585378b4ca56524cca810abfe259cafb84233

  • SSDEEP

    12288:xMroy90xYpheCw6r+QxxBXkLJzuonD5QqK/I:RyD6JE+wTcVHaI

  Score

  10^/10

  redlinefudmishadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1