Extracted

Extracted

• • Target

    e8dc1529e42c874d67b9209c41f18e5956e6da1b67b445ef36d9eb3c12df7f66

  • Size

    540KB

  • MD5

    d7157325e756046adbd60df87d06c964

  • SHA1

    584a43245a22bfa3fdaa5760f4633e986446ca6c

  • SHA256

    e8dc1529e42c874d67b9209c41f18e5956e6da1b67b445ef36d9eb3c12df7f66

  • SHA512

    f5755942612e14db82a6fd8a05086a3d43566b3ce8058dd9802c25df03d657271e32ec0907249d4b36daae51352c5fb4ebefc934e1d0cfef29335f6b5bac789f

  • SSDEEP

    12288:zMrZy90YJvGs0EvTJoVnKk+zrEbsY6xsI4+OFcgoc8Ghz5OFWTNQ:mylGZmm9mGsYaJyjogXLC

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1