Extracted

Extracted

• • Target

    86b221bef32075c64d3f9a8431b96b2a5dadeb3f4cb614821b3ac13566b4958c

  • Size

    866KB

  • MD5

    e67e4166a8423d5332a0d4a3e84bfeb1

  • SHA1

    e1985ae6867dfc815f0cfeb311aa7f6a71733caa

  • SHA256

    86b221bef32075c64d3f9a8431b96b2a5dadeb3f4cb614821b3ac13566b4958c

  • SHA512

    45db307470aa0bfb914882c40e4f31c3f02c68a548ca6d3fccbee049dea0ec41b1d5316d14a119fb001a2373ffd041da572cc908208f20a473693c95ec988a23

  • SSDEEP

    24576:cyUSrqVy7ErqEXAOmnbzikhiV2Lu0yZXL:LUSOFq2mn/iW8v

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1