Extracted

Extracted

• • Target

    f3b441db7e956b4c449806fe0013d5c8adbe0b8e5ab8c25aed43b95a6c372656

  • Size

    679KB

  • MD5

    0d474b793799d4fc0ccaafda3fcdc5aa

  • SHA1

    fc679ac11dec737919a5b2c4edaa4efc3debcea0

  • SHA256

    f3b441db7e956b4c449806fe0013d5c8adbe0b8e5ab8c25aed43b95a6c372656

  • SHA512

    c5e27ec8f57f7a5f433f106e19fdf65f1c84819ed853a70a8dd92500dfb87c8149e93b2aa6beee1bf0267b2cac0293c9fc5caa5227ded5612669211517cc3821

  • SSDEEP

    12288:oGHIGD4gZKt4U5Mu3iTTKJ2e32cc8M1o/SldCnGoxkqeYBndoehW8ArY+v4://HeDoTKwC2r8mldwGWkCoevSY+A

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1