Extracted

Extracted

• • Target

    4eedd47f454bc4d2c2b2bf773b3b21d0ca08fdd58b7f353042a642c31d674aea

  • Size

    681KB

  • MD5

    24f72d330d103c25d65c8a8d53b20102

  • SHA1

    a8106162bf6afb6e72ae734f1821c7fd26716667

  • SHA256

    4eedd47f454bc4d2c2b2bf773b3b21d0ca08fdd58b7f353042a642c31d674aea

  • SHA512

    20d90befa0de769783a209da99b1d4eadbd9e7e3c52d4df986fdc127a0ce6d4d0cea2525757b091b72b6f3cc6f4d654d80d6dddd300a680f81c74e40de26e205

  • SSDEEP

    12288:mPe+vq0DftpGsNquO1jdfm6ttNA7XTPlszMd8wNYyRD:erftpIjdjNA7xYMrl

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1