Extracted

Extracted

• • Target

    5cc79af8ae00bb2e06a661659801dbf447832b2ce310403b03b5f4d54f6a8cdf

  • Size

    545KB

  • MD5

    fdbef36100ccc8d13e17cd4bb7045fbb

  • SHA1

    ab4d3e18a950e20429618b6f0135cfc8577cd832

  • SHA256

    5cc79af8ae00bb2e06a661659801dbf447832b2ce310403b03b5f4d54f6a8cdf

  • SHA512

    f8cb09b7dd97dfd7da11e089240c246e35514421cdd1e72f383450fa43455df30f2e969d6862d72cddadb176fcd0d0da1435c39262a62aa13ad3e8370bbcd79d

  • SSDEEP

    12288:HMrUy90bUiYwV08nYjMpMSqvnFSOCNv3HXtRYkNyU4GV:bywrcMpngn0OCN/HXXYkNyU40

  Score

  10^/10

  redlinedownlowndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1