Extracted

Extracted

• • Target

    8bcf1d366e4863c9301e79ea6aa70379e4b77d8bc60f843cbde0c63a717844ba

  • Size

    876KB

  • MD5

    c5affe8bbad9dd13ee70f893e34fc219

  • SHA1

    8aca16a71024b420d76bf98b1fec52080ef09663

  • SHA256

    8bcf1d366e4863c9301e79ea6aa70379e4b77d8bc60f843cbde0c63a717844ba

  • SHA512

    b82b8395d33de83f3a98c8baa8acfa063c5399adfb95d0fa5922f814e32b996c9e695c80abb7fe6f337dffb5eae42b91ceabc800341a56bdbebc3a4aaf12034a

  • SSDEEP

    12288:bMrwy90oCId29rzk/D4R5EW+dblzTSC/lMwAEBdx2NzgPe0XnNqyqZ8GjWoXteek:byb7SedW27lx1t3Ayq8Gjjz/M

  Score

  10^/10

  redlinegenarelondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1