Extracted

Extracted

• • Target

    74e973d54085771986b6e5cac15d854089b2d814636887f79b71227322c2f331

  • Size

    690KB

  • MD5

    2a5f630a9e7d393b8145d2845ff7b321

  • SHA1

    018fec626c2b831b3dbfebcd8e95edf514d1a857

  • SHA256

    74e973d54085771986b6e5cac15d854089b2d814636887f79b71227322c2f331

  • SHA512

    b5b6a7bac9040e71bf7b0fbf6fbea19b2fdf911fa78d7394a8a619c48b1763cff2e70b098e2ffbadfecd1ec982cc8e86491bbb099956443e4bd12bce805732f3

  • SSDEEP

    12288:zFUDvXKBqTqHFB13Npd92vgobCxzKnqe+8znvv/F4DU/2CdQxwQ+JOAxB:zFU7ZTqHFBPX92jNnv3FADCdQx+P

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1