Extracted

Extracted

• • Target

    474850c4713788598c15c5553cb24fadebfbde6e69742edf4b73621701fca319

  • Size

    836KB

  • MD5

    56ff4d1b680fe0ea4c4bf039caeca205

  • SHA1

    42cefc68c1d661f7339a940df2749689ea4f475c

  • SHA256

    474850c4713788598c15c5553cb24fadebfbde6e69742edf4b73621701fca319

  • SHA512

    0ebe874d6641c6c57a304592d9ee1084d4432dcf313fe8b5cc3b3370c26fa89eca4ddd06d9541c4ee295c986c0d78416ab49acfa97fba8c0dbbad190f6da4c62

  • SSDEEP

    12288:0MrQy90PE1iWOXUJDTDEZGqgEGHJrPYPKZwkC3Qky5bCvDBRzWkUYCL4yZs:kytPoZGqBOj4KGX3SVCvDH1SZs

  Score

  10^/10

  redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1