Extracted

Extracted

• • Target

    cb7f95dadc6d25c6332f8917b50504585be2488149561d01d28b31681b6d5913

  • Size

    551KB

  • MD5

    d7f36449586bfc7f2f2ccff57a3c82c9

  • SHA1

    605d52a1e0311c8800737426ee29648e2bce0d0e

  • SHA256

    cb7f95dadc6d25c6332f8917b50504585be2488149561d01d28b31681b6d5913

  • SHA512

    f857441912255b854c8db1230669dc5b6a2a53f9b796876026b9239bf8bddd29f5857fd966dab1fd2b423bcd73d5ebb4b5ef7a4b36041a399a577aea6846a5ce

  • SSDEEP

    12288:0MrEy90EwKZ0KMsVr3lncsuwr2pc/QC9nBU196MyJ2rg:4yhGK1p3VpKzeyaP2k

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1