Extracted

Extracted

• • Target

    5c0fe3de9f46d3355f9aa19069c4ba46fb60e2810b0ded8d7ef73d8f23ff1d3e

  • Size

    539KB

  • MD5

    7ace72dce52bcc2d80c75de97823dfcf

  • SHA1

    00d349f3e8fb6d46d7d46292042604fece435f8b

  • SHA256

    5c0fe3de9f46d3355f9aa19069c4ba46fb60e2810b0ded8d7ef73d8f23ff1d3e

  • SHA512

    3195bde0bcf031e217299886f50cad044382b141a17a174e289fa7d9fba1e8fbd19aa8084449dbb67a2553765791ebbcc243c75131201d4107ad34bb8d6dbbd6

  • SSDEEP

    12288:+Mr3y90RK6fWmP5Mor1yH29c9zMMHQKN1Jo7lHQ5CqO:VylmP5M6gTHQMWHQEt

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1