Extracted

Extracted

• • Target

    cb3e32f670453411fbb8a7a63e7f1b31f001e8e0aefcf70bdec5f2e057f78e4b

  • Size

    851KB

  • MD5

    f4c748148f9b0430c4c40b3efb6d37f0

  • SHA1

    85fe5d520d67e35745a562066ce83522fd75f762

  • SHA256

    cb3e32f670453411fbb8a7a63e7f1b31f001e8e0aefcf70bdec5f2e057f78e4b

  • SHA512

    47a9f6b6bb3aa3bb21cc860f09fd05e16c1ead58c613735f0c046a560dde4c792f47155294cd7ecb7a1e2121de3b381a6780fb83d54faae9a37b1c441223c7e8

  • SSDEEP

    24576:EyAR33zZNuFdN8nggCX/CD0yQHmp1oq3lx9:TARH1YFdN8n9PKmQq3l

  Score

  10^/10

  redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1