Extracted

Extracted

• • Target

    d34b2b6df296a78af7e611d6aae2899be06fe4251ce231761783b1bd903215fc

  • Size

    544KB

  • MD5

    9c982c139ac24258fdba8fc52b5714e4

  • SHA1

    025e0505497a2ef3512903091562dee4991d04a0

  • SHA256

    d34b2b6df296a78af7e611d6aae2899be06fe4251ce231761783b1bd903215fc

  • SHA512

    e38764b9a808e6e03a896eda346a1e31774ff828451d6fb72e61a3de163a0ad95efc17561ca4ef1e73cf79a6c670df9bfa44105fb9e0ecb95c7341f9877686f2

  • SSDEEP

    12288:HMrYy90BZ1yiof6B1lDIPRIIqgUvMLZwpzv4ztJeXZXhsRpXQ:byFioiB1y+EKMNokWfupA

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1