Extracted

Extracted

• • Target

    8fdcaa817ab20b80c3c152dce5cefe19e1ad79c060947122bd9e5b45554a32f0

  • Size

    836KB

  • MD5

    b2ae86a7a394bfd92885bf965488688f

  • SHA1

    57dd12246541a1450352c32f98c2cac74696da01

  • SHA256

    8fdcaa817ab20b80c3c152dce5cefe19e1ad79c060947122bd9e5b45554a32f0

  • SHA512

    07cfdd0a9638bfa36b73d6d6dbd262288ce95ae3f3db65ffdc7b2e37090fcfe75163bdf2e45eb1bc8d670ef773533db9259d51dcfa16bba39fb16fbfde047fa4

  • SSDEEP

    12288:KMrDy90N2T227bPCg2K+iIpgZh1PejyfdKG1DdVt/CVr33w9PDk7vDB1MWkUMGip:xyuInPCCqOT0Gx/6bKA7vDX0GT6

  Score

  10^/10

  redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1