Extracted

Extracted

• • Target

    5590daedf245e8aa85c5b6e81ef8e4466325ff5516c0618385801788d20521fd

  • Size

    540KB

  • MD5

    7710d5e5ce7d5dbaa5cede6622cba24b

  • SHA1

    c4fd95808e11933c412d1e0d4a46cde7d3e56e25

  • SHA256

    5590daedf245e8aa85c5b6e81ef8e4466325ff5516c0618385801788d20521fd

  • SHA512

    ca707a3575c91929c5fcd7cd32f804847b57c6bfa5cde7f3e6cecc9932ca2e7639575243dbbad044366f63e54d4e568184bcae2958a2a6b25c5162052a4c6d93

  • SSDEEP

    12288:7MrQy907Z9GRVGKNuPMC0ZILwUtyZM0KF96GRdHFmhA:3ySfG7GKBZILOKF96CdHF+A

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1