Extracted

Extracted

• • Target

    b62797f04e1ad34f06e3c18c293c994bba2b40a31982d03776a6697b8812c0d2

  • Size

    539KB

  • MD5

    5174c12d65500c3fc3eb787e627d7f07

  • SHA1

    1f6cfbbd3b4e84ca91e7b1902a4122654e3db27e

  • SHA256

    b62797f04e1ad34f06e3c18c293c994bba2b40a31982d03776a6697b8812c0d2

  • SHA512

    596c15c76e8b32da3c9dbfd08063f4feca4eda225f35b9289e8dfad4707f3305a28723a3da2f685b5d99bfc8d2dad2b7b018faaa1f906cc2a50e80dde8b88cac

  • SSDEEP

    12288:9MrOy906EiKCvN4xJTA1BEf9BDn9GYgxuI4+IXt3MS+f1md0C1:PyrN4xJUXEbD9GYAHKWSC6

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1