Extracted

Extracted

• • Target

    fca5999f3e50c945d43a6467a03afe2b6a594d02c21c8f3ed7e4edba1b60fcc5

  • Size

    819KB

  • MD5

    9f4ee426fb2d5f5a494ea7706638c1e1

  • SHA1

    61c129e0eff5e1098ff4a0deaf73f3d986b9af7c

  • SHA256

    fca5999f3e50c945d43a6467a03afe2b6a594d02c21c8f3ed7e4edba1b60fcc5

  • SHA512

    bd52fb463aad5fc0f904c2761e0240f77775da94ccc7c10a8e15e120b6763f7c4b69e5105128870d183a161bc3303f510676cf35dbacfbecb1696e158607bc29

  • SSDEEP

    12288:fMrmy90b01HecTJHMxIXaEK8j3ihmVWa+5fxn/IRx8UuTQ2V6zgux/iXv12AIR:xy2B6xMOqEF0mVW/5Ux8UV2kzGjC

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1