Extracted

• • Target

    ec957d2eda0974505dea911240597d658e8e558bd60a8df7b333868c4b756796

  • Size

    409KB

  • MD5

    f7a34cc4e66f3042e4ae4775460dfff4

  • SHA1

    509856fc0142e3c9b140ed1b1b9592d497af3d52

  • SHA256

    ec957d2eda0974505dea911240597d658e8e558bd60a8df7b333868c4b756796

  • SHA512

    1ed60ffc521407d03e1b3f9b3b7ee16bc1e34936855dca3e76294298c8b772611fa5698db71b4f1d61e0a48c61386803ad0791ab0eaeacc854e31ddfd383a824

  • SSDEEP

    6144:KCy+bnr+Qp0yN90QE1Vw+oMY0G1GA4q9bUC1oif/F9FMxpUkx9wwso1IH3txz:GMrMy90vVlun1Z/DoO/F9GxpUkYi1s

  Score

  10^/10

  redlinefuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1