Extracted

Extracted

• • Target

    546b8ceb769c1706ec14f0717163450166d8d268972014add44ddc6f9d341ded

  • Size

    787KB

  • MD5

    fb5bc7febdfdfd91c438f80a34655878

  • SHA1

    1327c9b29c84a6ee1c4bb62406d4d96722229ce8

  • SHA256

    546b8ceb769c1706ec14f0717163450166d8d268972014add44ddc6f9d341ded

  • SHA512

    ab8744e0d93bfd898bf9485d3d3e02d814cc3497562724e196e0e9e7b9e4bb140c65c7d423b56bb27839f23e3d2f91f37e8bfb996ddbafa927d7e872dcc4a06d

  • SSDEEP

    12288:OMrJy904IeZyLm0QvqbTFV7QEg+r2VI6gZGC4BFn5V2y9haeRCRKcC2KV:/yrwX15nLsI6govHnBseARKb

  Score

  10^/10

  redlinemangositodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1