Extracted

Extracted

• • Target

    8e71e8e04fd8b3702d45c5d72d95df744dfbe9e3cdf7a27a556ec85844fc528c

  • Size

    538KB

  • MD5

    b64d442080acb54435240ef0379deafa

  • SHA1

    bd72885a9eb4c0eedeb14a9da572fc2131306262

  • SHA256

    8e71e8e04fd8b3702d45c5d72d95df744dfbe9e3cdf7a27a556ec85844fc528c

  • SHA512

    2b1786249ab2ec430f534e8a387214475f65e772bfcf2fd6928aa43fa49d6f6a06b9742594cb22d653b347946f8b58ec0b553947a18b35da0d030c3d4139fc74

  • SSDEEP

    12288:EMrmy901W8/xeOL/K8qAzJsZ952QlYaxKI4+9+ROE46kll6gO:qyD4eOuAzJY95DlY6j0J46kv6gO

  Score

  10^/10

  redlineboltdowndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1