Extracted

Extracted

• • Target

    fe81b675f8b1d1695b6896a93887321de3701259f5905ada1005c9e864bae0e9

  • Size

    779KB

  • MD5

    896961f0853f5a1d777492e9ba4f5ebb

  • SHA1

    45592c0f5dbcef8daa464b6379d0f86357dc3415

  • SHA256

    fe81b675f8b1d1695b6896a93887321de3701259f5905ada1005c9e864bae0e9

  • SHA512

    92b96a8459031c695a5730efb0848f01b7f190c63b34fe195dbf6ae0468a943f3c91b03b4b394b62af7c1f00ac745d14c14fc14113b3c2f610fc7e136f5312d0

  • SSDEEP

    12288:+Mrfy903IcFPAsMsLPv4tRd+2xuhDe+k/94FSbZD9gzKXn4d5pccrgz4YeE7fp8:hyQHItRd+2xuhCV+SJCO+5V89fp8

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1