Extracted

Extracted

• • Target

    ee4ff5f881f2e414a277f360af2289fb3d63f67088bbdeb8f6a2c02703b6ff6a

  • Size

    540KB

  • MD5

    176e483e4499a23bd6746299bb23cd06

  • SHA1

    f80ff7209bf936ee49ed16d0b02d9630c74aa936

  • SHA256

    ee4ff5f881f2e414a277f360af2289fb3d63f67088bbdeb8f6a2c02703b6ff6a

  • SHA512

    4b15a9b4ba46a849f17ff6a91a3e315a053f2b0b95b9eb459cd7ed052397f59a894d2441c35d38760dc71b48eb9af2e19ccd0885dece684ccd113d96627fc420

  • SSDEEP

    12288:MMrwy90z0Uvw0+TpgB2grw9UdNQC5C0U0OsIVaBCKS:kyI0Ab+pgrNBNH1IZ

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1