Extracted

Extracted

• • Target

    644a69d7a8ab8d84f686f24e30b12cd21699911e8a0ee7cef8bdae4840cc8667

  • Size

    818KB

  • MD5

    683b68fec2236c364f13a40f78fcd8cf

  • SHA1

    043ff22f809153d1fb5f8da442a6337f27d3aed1

  • SHA256

    644a69d7a8ab8d84f686f24e30b12cd21699911e8a0ee7cef8bdae4840cc8667

  • SHA512

    c460773dfee9438c41fdae118b27b85778ebc9ca33a87127904c590fe55473b0684d541dcfcf13c7d24208f9a7e347d7dccb45b85c9ef77efe42faed5667565f

  • SSDEEP

    12288:9Mrgy90spivgcuraF3iFbctjTQu6Wnp1xPLtEqE8UhcTVV6zggdbwx1PQIc:hy1CgcVuaTp6WoqE8U8VkzXbwxRQ3

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1