Extracted

Extracted

• • Target

    7e497e5facc3b2bb7d7ad2a3da5823214eb9a7cbac44f07af57779507cac550d

  • Size

    539KB

  • MD5

    c35f33450e086c7b2113694fc0778cbe

  • SHA1

    39de7ac6573d6aaba1f290107c04b23714ff2f3b

  • SHA256

    7e497e5facc3b2bb7d7ad2a3da5823214eb9a7cbac44f07af57779507cac550d

  • SHA512

    b41fbff1a6ec47494f0c52a845c9593910114db381b457afded1e1611fe9477ab1be6af618dd981b10995807c87f322c36d8c80a39bb4bb41016b6b1d3105c83

  • SSDEEP

    12288:SqMr6y90UROvpvj+hjL5BEpYTxmI4+++RZ9kVbWhz:SMyZAp7+hjL5mpYN/phwb6z

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1