Extracted

Extracted

• • Target

    8a2f0154945b020d64df9591986fcba7618a26f947b6ad18f1ea211d1dcab7ac

  • Size

    540KB

  • MD5

    43b994bd09624d051066d659c257f908

  • SHA1

    824b0830530d90b4fee45fd6797bb57438922361

  • SHA256

    8a2f0154945b020d64df9591986fcba7618a26f947b6ad18f1ea211d1dcab7ac

  • SHA512

    5451874bc2d4a9b6f4ff21616795f37c1989e66c479838161bde0edb404c0273f43279b6134015b511f316506cf51857f03b84d90f6059be723c1f22af765109

  • SSDEEP

    12288:xMriy90KirZkhkBbQJnX0Dy/ss2MA2Ro57jSolKX0:3y1iVkhUQKke2RopjiX0

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1