Extracted

Extracted

• • Target

    f54b49727543f5ffad1e196b439467195f2a9c348fd4ccb32b027cf6670d9d24

  • Size

    818KB

  • MD5

    cedf9dc36189f7b509953d8d31d9c1ad

  • SHA1

    f1ac8520b1a6f1f277f143a83a26b4f85dbf9971

  • SHA256

    f54b49727543f5ffad1e196b439467195f2a9c348fd4ccb32b027cf6670d9d24

  • SHA512

    6677d5416732e143154495ace6ac43b41472db10012e339d59fa86e7d4a66cd449d768041a6fc9af5b279518f5ddbf52df10edc47ea4a68aaca4e8f169a938f7

  • SSDEEP

    24576:vy957QbfGXfi6WEl4gnCF+v8l8UiOkz/w1SsZTeZR:6TkbIflemAA41nR

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1