Extracted

Extracted

• • Target

    4c03cb97506b770d1e1f3e22fc965533d811f73ffe5b71a9716762a94484d40b

  • Size

    777KB

  • MD5

    309c99d2bc3e4d0afd95be0275432158

  • SHA1

    debf2e8beb57817fcc32eac30add37d8828fc8e8

  • SHA256

    4c03cb97506b770d1e1f3e22fc965533d811f73ffe5b71a9716762a94484d40b

  • SHA512

    7264c45428e1c765b8f2aa7b0464709e8fc6a5f9f4e7db88c6bdb0d2f534e6fb3d5e2655e4c3fd25a8e1eb80299cff421db4f3adf129ec40f79b0b5ae2c28b43

  • SSDEEP

    12288:pMrqy90kNvRVq/2F3p15xuTxph5Jc9mjIwT7VrfKcqjIMOlT5IQUlTBd8D5t:3yBrnp15KH4mjIWrtM4IrTBWDL

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1