Extracted

Extracted

• • Target

    9b61f0b6422652341f1998945259f9adb8dd203472cfcf32e48a946d649a3416

  • Size

    539KB

  • MD5

    1d335931335e5183138eda384d9023ac

  • SHA1

    39871bb9b22cffd625514d3ad59ea7d94a621bd3

  • SHA256

    9b61f0b6422652341f1998945259f9adb8dd203472cfcf32e48a946d649a3416

  • SHA512

    0d05c2b55fb9f3c6ec85163606c61d3a414328a3c03a94064365b74ffc1f0bdc2fca2d3a7265fb43b9776380fde1405f8f1d89cd79afae3c29caf5090ea6c66f

  • SSDEEP

    12288:lMr4y90qszHkdpVE410ux0vFZmGvYrxQI4+zyrFkLU1lEICBJ:9yMzHs10uWFZdvY1duBkY1lET

  Score

  10^/10

  redlineboltdowndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1