Extracted

Extracted

• • Target

    84e6aac791bd779b2ab334c0501c4a3699f83b1c58ea93f64e3526be687cce1c

  • Size

    544KB

  • MD5

    687cdb834a3ebc469c40f1d3c43a604e

  • SHA1

    bb6da8af245d400085d4fb0c920daa7ca26a1a75

  • SHA256

    84e6aac791bd779b2ab334c0501c4a3699f83b1c58ea93f64e3526be687cce1c

  • SHA512

    d2768632388bd850678f1d91a8c6af54476c5f0eb36945191e7c0ddc844d6e7b6eea921df5af863133e6310df92a26c9214111b432e60a3dd810459f37ecdecb

  • SSDEEP

    12288:WMrMy90V2ENaLANztzRDwreEqgULMLqwS4zwJOXa9F1QT4:WyMLZtzRoOMuXkfNT4

  Score

  10^/10

  redlinedownrealdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1