Extracted

• • Target

    88e2c224f157a4c5110c8ad9c703f79a4c92528bfabfb16b6e362a274157e1c3

  • Size

    550KB

  • MD5

    da17fc5dd66861c9a11d1ea8c10a9b23

  • SHA1

    9a65b42fe775d5dd2f0a4c6969cddb449b24228c

  • SHA256

    88e2c224f157a4c5110c8ad9c703f79a4c92528bfabfb16b6e362a274157e1c3

  • SHA512

    04f2375f545bcef77cefbb5e306c553f5ac0bdffc3eda200e85167fffd19ea2988207b79eba4f2bb36cf20671436a597befb419256c15dd3e6ce5db66ec0aae6

  • SSDEEP

    12288:WMr+y90Aahimz7AuxqVlVWvo6dfmG85DXHhzjGU:wyZsVAuxYj+6DlH

  Score

  10^/10

  redlinefuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1