Extracted

Extracted

• • Target

    cbd137063c101eb620c4cac83c346b013d16f48b603155231866b9729c348667

  • Size

    682KB

  • MD5

    ed07df2b64e8ab99c598c3fd8d092454

  • SHA1

    346ba353a90c983e2a7b59ae77321496755dd7c6

  • SHA256

    cbd137063c101eb620c4cac83c346b013d16f48b603155231866b9729c348667

  • SHA512

    ba9b0527a100378305ca37f0e6582fe80ee7901e414ca6c9f2165f59f42c57f8c57eb51ef47591c8eb7dca777c928d472c6cb60dab1135d7162a82e09868dd56

  • SSDEEP

    12288:E/2+N/Arrf2R06BkiV0xyUT6AxqkOivzDLPkh6FwbyK8icKiRGy:EdAfXiCxy66AxqiDWtbyKdFy

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1