Extracted

Extracted

• • Target

    23e2acb255b33dc3dbdc49b5437f500d35ea8586e70dd8e9668247e0c6ba5c62

  • Size

    777KB

  • MD5

    e194421aab5b3a3fb3454942a77f9a3d

  • SHA1

    5f21b01797446cb1f59eae1fafd2a754fa66f9ee

  • SHA256

    23e2acb255b33dc3dbdc49b5437f500d35ea8586e70dd8e9668247e0c6ba5c62

  • SHA512

    f8409691d5a939e13f44f8e13ac05e4cccec511e1f37bbc904572e908781de9b43cbeef6848e1d753b01a5b5d55447867ca80663e9f65c5c5b196bbdff54f61f

  • SSDEEP

    12288:RMrXy90jUw7FbtdDpKVxMr438uUJGTnKU50M5NUdT3fJeyJjcAgbt:KyOUwVH89suuGbKU50M58TheyJwA2

  Score

  10^/10

  redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1