Extracted

Extracted

• • Target

    4fd50bc25f2ec77a1eb1f43c5d0aa3c4b56276b38cec198355c03a5cea7903e0

  • Size

    539KB

  • MD5

    5c6eb6ec3de917a3f1062420112752c2

  • SHA1

    b8016a6bf62c025c4c3b955c4f8f1e3c685e6951

  • SHA256

    4fd50bc25f2ec77a1eb1f43c5d0aa3c4b56276b38cec198355c03a5cea7903e0

  • SHA512

    7e062f3b6a9c36e22db37ac09777b8bd6f338e6c44ba39aad42ac5987e07d31c3db0cf4d8522e7328f3454527223d7bdc809acf460259973586494e881485338

  • SSDEEP

    12288:GMr8y90EYN909JDbUXUV8bbexfI4+4wPr4PNug2ftcp:uybr7UEObbuK9MPNl21q

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1