Extracted

Extracted

• • Target

    065cf9a64bee4df600a1c30021f4770d9b1b612f096c12f13fd8f3632d827050

  • Size

    681KB

  • MD5

    7d42fad17bd9dc109dd705d6fb2112cf

  • SHA1

    153067ba757bafc90b7d2cc6f2e622c968e9b7fc

  • SHA256

    065cf9a64bee4df600a1c30021f4770d9b1b612f096c12f13fd8f3632d827050

  • SHA512

    167327bed4037b3ac1390441673e49c51394ad9fc98ea823779d2364b2647f8819fe4aea5a9a0d6950bd6b0c7c805c05c680812634fe7c335a9138d1b2993c05

  • SSDEEP

    12288:R2ojBKZrg5SmePIA7/ELeej4rWLryxMsnlKAmPctv79HhcklY4XaUPpxc:YK+c5SmLRjFLrZsnob0N79HhPXDPpS

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1