Extracted

Extracted

• • Target

    29d646cc40d5e36df89c930f5509e65b22b8fb0be1b5889baab7e1028c1f4318

  • Size

    550KB

  • MD5

    279927a4e7924a6d31ad43cd16289fa8

  • SHA1

    9db65b8fbea7fd21dc49f27101ff2e6191d187b7

  • SHA256

    29d646cc40d5e36df89c930f5509e65b22b8fb0be1b5889baab7e1028c1f4318

  • SHA512

    85c80ff1a2c16c848f1181aa69ad23643466af2a86bd5fc750455959d92bcb13b0a114f04e30098a1a0118d250afd5b873b7974c74005e83c407e9057a23c5d4

  • SSDEEP

    12288:aMrCy90YvDPUE3NQaAfHpxUl706B0k1cjZ/T/xWJyqpS:kydvDNdvAfJxkN+ppWwqpS

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1