Extracted

Extracted

• • Target

    a7d34d3747f69def47d51e6928a6adb22b11559a49851fd85f64e8d70d862428

  • Size

    540KB

  • MD5

    877ec18380656e6f9d92d459dc59ab8e

  • SHA1

    aa028e949cf702edc77c57c0c659c5c214e6e62b

  • SHA256

    a7d34d3747f69def47d51e6928a6adb22b11559a49851fd85f64e8d70d862428

  • SHA512

    26664833d374edc454eee0c36cd08431ac1063f01353b8cf5bc64291e5c2b47da7f084bf21d1650079b7a50b9ab130884db9313c9331d0a718e96339c25607b1

  • SSDEEP

    12288:QMr0y902TtHyHrszoQ0D5exHsktFlMBYX6uC5SWSZLy:0yPop2laYXHCgZLy

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1