Extracted

Extracted

• • Target

    9e770aec9da4a20c666c1761fcb60712e5f91fc925bc25c99cc48a5b619f9401

  • Size

    677KB

  • MD5

    d709f8861148543d36adbb1b08169205

  • SHA1

    946faf044ec952b9d5f7e6ac7cf3acf0fe8a11da

  • SHA256

    9e770aec9da4a20c666c1761fcb60712e5f91fc925bc25c99cc48a5b619f9401

  • SHA512

    547dde4c473db7b1a69cd0dbbe7ac939aaa8514a64735377bdbb47230e5f0ac90317d2d306ca29730074fffd19c67ff2ebbee8e95613f947fd5183b358daaf6a

  • SSDEEP

    12288:xmJXlOXyAUe/Ui91gt+aSfJUO6JJ0a0/Civ9jeyP13QZs:IjcyxgzaOq0L1ZQZs

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1