Extracted

• • Target

    fe8495d7657918cbdc3f0f8f1a77762739b24029066643f5c7c82fb16f40d1f4

  • Size

    408KB

  • MD5

    6aef45155f3578725a674da994fd122a

  • SHA1

    745c0599b6cf5d8d7670ab414fad8bf30fb78a52

  • SHA256

    fe8495d7657918cbdc3f0f8f1a77762739b24029066643f5c7c82fb16f40d1f4

  • SHA512

    14c7b4f6fee1dfbc28dacc9efdaba3b729a767e6b83765a20bd6e7f1ed43f7b314b5a2e0bed3528af5d53d8f5ca7c8d59fb24676fe0b522ed445014ef28e1383

  • SSDEEP

    6144:Kty+bnr+Yp0yN90QEyPxwmoz6YrHNhfdPgrcwSRp9n/LERcTRUQXPYP9G:XMrky90Gw8KPlWcRX/LEQs9G

  Score

  10^/10

  redlinefuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1