Extracted

Extracted

• • Target

    6c87c9f560c0d4114e0f73d21f22247c8f5bd49b9ea5c2be8f8b98c904b063ea

  • Size

    818KB

  • MD5

    7ec5f5743b582f9b3e8f9f15e274b817

  • SHA1

    c5f9d1f8e0f0669b6cbc9a68779692b102aaae15

  • SHA256

    6c87c9f560c0d4114e0f73d21f22247c8f5bd49b9ea5c2be8f8b98c904b063ea

  • SHA512

    652fa7e95b7d6a787b6adcf15c44666e28fbf39d0874a7cd366a5e95c343b5ca3b1caa323999a660ee40a758a523ccbe1fe53e06e6a00aa194973082c413d83f

  • SSDEEP

    24576:Ey7FE+A+PFyV9SCL3+vvdBZFDA4uXnkC:TBtpGSCL34jPDA4uX

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1