Extracted

Extracted

• • Target

    9fb8c47e74da8ebdd1b11d819594b41ec54f71a5137cac968f5cd383b9217375

  • Size

    550KB

  • MD5

    da96819b4d79ecaf5cb4572df8113629

  • SHA1

    4511ae9b4c52dbe81f54888195c9226a0a905f64

  • SHA256

    9fb8c47e74da8ebdd1b11d819594b41ec54f71a5137cac968f5cd383b9217375

  • SHA512

    6a2411864342a1dca4f037e117757f41eddadb25c9143a272cab542b895231f5482d2b92e2064c13e9a14f79136150903d09de81a286e1d484e4ecce2d71938e

  • SSDEEP

    12288:8Mrjy900yHteb4Ia24+1d2PF1fhH27v4pPSfU+ZQ8Q9pqPGEGYUw:/yf+0mtPF15H2MpafUJ85qYR

  Score

  10^/10

  redlinefudmishadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1