Extracted

Extracted

• • Target

    a3fa1d1b695b493bdc5d881cd72bc94f0ef53f451c3297ed3cb82f139fd25ee6

  • Size

    681KB

  • MD5

    3b504ddbaedade5dfdb64adf06a84f7c

  • SHA1

    b5cd5efb42d828a463fc7916c2972efc37307739

  • SHA256

    a3fa1d1b695b493bdc5d881cd72bc94f0ef53f451c3297ed3cb82f139fd25ee6

  • SHA512

    6f339ec049645caa6048f9727dddc9840af33654f573482eb4a6b6eedbc0e6c05b41290cf65cd0eab80dd3cb086bb26eeb761ba1c89d21a0e379b9e475a26238

  • SSDEEP

    12288:nPe+vq0DftpGsNquO1jdfm6ttNA7XTPlszMd8wNYyRD:frftpIjdjNA7xYMrl

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1