Extracted

Extracted

• • Target

    51190613b2156ffe558179cdf87f615cacc5617e4127b024c2fa65e97d5ada98

  • Size

    539KB

  • MD5

    f189c3439ae40cea298521657954f85f

  • SHA1

    2bd5c5ca9ad187bd4272990684200e998cef9aaf

  • SHA256

    51190613b2156ffe558179cdf87f615cacc5617e4127b024c2fa65e97d5ada98

  • SHA512

    e5ac9a1dac66c392f66b98f26a2bed62798d186f93fe5ee977707cd6aae837d1b25ba294d85d85c7fc19aea90903bf9f0a75f81fd7cfc75ff6cac4003587da2c

  • SSDEEP

    12288:TMrTy90QGN9x1BWpMMtkUNKzggsZAowjut4HO:Yy/GN/1gpM5OKzgpAowjut0O

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1