Extracted

Extracted

• • Target

    6bb8d8629d3dd1052c023fab520b5529389e53994dcb892461856c3fd9ca1253

  • Size

    539KB

  • MD5

    aeea97ad272445c5e307f4df37fdc215

  • SHA1

    567fb8c2cb71c959010e78eb707eb8881a9b89b9

  • SHA256

    6bb8d8629d3dd1052c023fab520b5529389e53994dcb892461856c3fd9ca1253

  • SHA512

    0b2b579c9470415fbe9888dcc66ded1d0866bf290f37713b0e99bb5004ba64a608903d263b98785d1c53e6292d165acd09d01d9be046c9c3111a025d6c2cf99a

  • SSDEEP

    12288:mMriy90zIJC4/axfwGqaBFGxQt5Uf+MfCBgUV44hXQ:oyhlGBqg2CBgUV42Q

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1