Extracted

Extracted

• • Target

    5b8052c47a1edf5d88ce913c5be55df4c1c34c4a86de7002f38d1211aded28d0

  • Size

    680KB

  • MD5

    de0bdc496b71aef64028ec51ff800ac5

  • SHA1

    c796d68e52446552902f48a39c8a0a014138775c

  • SHA256

    5b8052c47a1edf5d88ce913c5be55df4c1c34c4a86de7002f38d1211aded28d0

  • SHA512

    3bccbf4fe76f614899414e656d1bd5488c7c8b56b1c9c65fa26a79fe5ba459c91a405bba0a3882a50bf590bf0c59cc422f9b02aafdc95eccf931ef7e29148471

  • SSDEEP

    12288:Jd898Pwj8PtYzZcDw15fuFlAGHroV43S3OSWGAozw2XeSeTRn:JT08PtIsuup4IO6oz5VC1

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1