Extracted

Extracted

• • Target

    ab14d7e51f7100c0403be2a7677073989d576c489768a5ddc44b9555b62dd392

  • Size

    778KB

  • MD5

    217f2b1a6640ba842770a77b15f28748

  • SHA1

    38332b361bd5678199c6f78fefab02b6011ab91c

  • SHA256

    ab14d7e51f7100c0403be2a7677073989d576c489768a5ddc44b9555b62dd392

  • SHA512

    c44b6641e845c381e2f34968b7c9f2143a98aa1a695e6bc6cd5c9897d94cd4a6bf72b9306ee0c2808c70e3a72812485ce76b0e94c4ba2b8ca9473c93b983918f

  • SSDEEP

    12288:JMrry902zQqOz2KgoCPby3m1I9zLF+eP2Wyqee78bkIGkapcp9DY0bJ/:OyLzXpoCPenvF+9qee7MkIZa6Yst

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1