Extracted

Extracted

• • Target

    91a0914125e5f2e449404f510d33f7e50c0a85b1beb64564072e75484c9df645

  • Size

    539KB

  • MD5

    4c1e5fa91ec86989a5ce53201c7f18a8

  • SHA1

    9d3c887245bf1bc2aed440fce9b9da2eef053e4e

  • SHA256

    91a0914125e5f2e449404f510d33f7e50c0a85b1beb64564072e75484c9df645

  • SHA512

    0fcf94306d3fc69e54c2a32b93596eb371faae3ffeb143801b1fd7b7e4312916204f175b29ee46bd984de2ba072a7567249f7b8c3232221565e2714142257c67

  • SSDEEP

    12288:SMryy90i7aFFFYAgGLI5223YoxWI4+gFDArdzX2udsZMV:Uyh7wFfc5B3Y4PUszxdsyV

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1