Extracted

• • Target

    a8735eff943948a66eb0c110de8cef46ca27fccc7203e3766e35c0172e5fa9f4

  • Size

    570KB

  • MD5

    0a2163aa7b82bf687aaf8784d2a90ef7

  • SHA1

    54050cb108f238883f89651fbaaf8269538be381

  • SHA256

    a8735eff943948a66eb0c110de8cef46ca27fccc7203e3766e35c0172e5fa9f4

  • SHA512

    affdd845c58be1cce8f335f644e783b07e8128644afafd2a5adef1a23ae51a5a527a054cc21220d8c29998d15a06262cf00842e8c3fbb0e2ba57d8ffca7632a8

  • SSDEEP

    12288:6MrMy90Mahimz7AuxqVTniC2hBGTD8oaaZc0:OyBsVAuxYOC2XGTL

  Score

  10^/10

  redlinefuddiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1