Extracted

Extracted

• • Target

    10b52a7f231da59e6f21f6626747c17a3e49f5592d0c4ff317ff344b89f9e029

  • Size

    540KB

  • MD5

    f40e5517e8432c52416407a40a7d8eb4

  • SHA1

    94a4f915c4d5f529bc944bbbf7689becf047d823

  • SHA256

    10b52a7f231da59e6f21f6626747c17a3e49f5592d0c4ff317ff344b89f9e029

  • SHA512

    e667a09ea8642e0e9f00c5ab463d21cefdd4667286d5fcaf5bc46ddd6d340005fd4c28e8e23d5475ab7cf204dc82bd4117dc324ad67971a57f5f8d4dc0537e10

  • SSDEEP

    12288:fMrKy90lkoXHruqLT1dxUACUARzAd0GtlzdyQo6wmjyV:Ryukuqq9dxYUAyd0Gt9Jo65jyV

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1