Extracted

Extracted

• • Target

    220636ffb989312300810a169a10cc5b023a067febd2c1f41e6883f76e913be0

  • Size

    543KB

  • MD5

    92360fd329dd55b5e8089a6b1954a13d

  • SHA1

    b18b1a84e2b87064bd8ce9ade55790416a5412cc

  • SHA256

    220636ffb989312300810a169a10cc5b023a067febd2c1f41e6883f76e913be0

  • SHA512

    5e2e5e9bca321a8fa7cf228a794c0e3d51718313d02ef01f0deb7699fffa43be76064c23c8cad497369a5cabd4f394cf97bc8d1f09ae3d60e4ccc125d217f734

  • SSDEEP

    12288:/MrEy9015MFPx7yzidRIQ5qCUvMLOw/VF8XLGHTp3p1:3yXtcW2MKyr8XLMd

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1