Extracted

Extracted

• • Target

    8b566d7de819b061a6170eef427c21bae8d4ece39bdec5fdd173da2c6951493b

  • Size

    778KB

  • MD5

    ee91d97c48558255657d77c94fc9df9c

  • SHA1

    7119fa2ad662892cad69a54091d06d9fe813afe6

  • SHA256

    8b566d7de819b061a6170eef427c21bae8d4ece39bdec5fdd173da2c6951493b

  • SHA512

    6a7811e489068b658b1f65b858b6b110412158829eccfd1f3d1de5425dffb7589ca1cdb4dc10afe129773eaef736ab79b2f04413bde742085a66f96540232523

  • SSDEEP

    12288:3MrHy90AbEB7iKbntl6j6CFQ28oY0GgCb+//gieruNFgU/6m/0P/Q3pCgb:IyJ+GItl6jpDBCnpaNim/0/2

  Score

  10^/10

  redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1