Extracted

Extracted

• • Target

    6c50843724598be0094e37ce0ee44724cd073fcbe4779ac9dcb157819cb71ef8

  • Size

    681KB

  • MD5

    83cca187c32cd176d91c9e8ed4cfbaef

  • SHA1

    b3ddc4838db99a4be8df2ac591981c3ba0cff5b8

  • SHA256

    6c50843724598be0094e37ce0ee44724cd073fcbe4779ac9dcb157819cb71ef8

  • SHA512

    8dce35235999c44f4d6b4506c4933fe5e50b4984d1e80d3112bcc3912a5cbe9f0829ec50c9bc5221a23b60dc3159145076e2aa35d5e8e3b855f82ff7fb0b1a6b

  • SSDEEP

    12288:A2ojBKZrg5SmePIA7/ELeej4rWLryxMsnlKAmPctv79HhcklY4XaUPpxc:5K+c5SmLRjFLrZsnob0N79HhPXDPpS

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1