Extracted

Extracted

• • Target

    a3e6817faa82106cfd5f950e69f8216f8d0519cfbbabee9817b9f13f2be9dc25

  • Size

    544KB

  • MD5

    3fdf1c59d7f5ebc55d6423ee678a0296

  • SHA1

    a0c3f80cc6281eade6363e63f283d954a4576491

  • SHA256

    a3e6817faa82106cfd5f950e69f8216f8d0519cfbbabee9817b9f13f2be9dc25

  • SHA512

    8dc74cc175a1e32e699ed459ad4296711185d93cf64f8e2f18bf9bf3a40ee0d17a74f920c1ed3c41b1c5d56d1ac725b90d1f1a18703a456cfab71de3040f34a7

  • SSDEEP

    12288:YMrCy90ET0f0Z0fl66+SqgUkMLsw5iuehbAJoZlXqJD8:6y6Fb+2VM4UixhE6rXq+

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1