Extracted

Extracted

• • Target

    a370d2c2e5a5ee621baa0e69a4edfb619e461b2e203290aa04392a4e19b1a653

  • Size

    820KB

  • MD5

    5f3d33d6e368d4efa97f0726b7aa543e

  • SHA1

    0d10ef7cdbc653092af232e03abe4fc613cbd1ab

  • SHA256

    a370d2c2e5a5ee621baa0e69a4edfb619e461b2e203290aa04392a4e19b1a653

  • SHA512

    93b0e112d16b50f7d423614368fc46e74675aba48bdb8eeebe6332ddafbeda9da67da1dfff2b241d922be78c05b718842110719b98e7f56b39b4b2d7b175e70e

  • SSDEEP

    12288:hMr6y90dFB62mKpO+6ho2RungmsNF+bpPEKdZ4plgU7GtKG22KnfliYWt/tN4nqM:jyMDIHqnNPE0CgU7GEflIxUx

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1