Extracted

Extracted

• • Target

    3b21b6d177f900d6421d86e57de489cafac4c2d888c8d3953a545c0c1c16674a

  • Size

    539KB

  • MD5

    a1f9d199a4612eeb9213c1b08583511c

  • SHA1

    fe821365913ca2ed715bcdc999391b236d4e6208

  • SHA256

    3b21b6d177f900d6421d86e57de489cafac4c2d888c8d3953a545c0c1c16674a

  • SHA512

    ab9d4d1238e32939b5932f2f9ef2b844173349cb02b46309a02569b07becb1bead495d0c6547911ef46f33b91de9c47fba6ddc7dd5d07364eb8a79bae3b1ea82

  • SSDEEP

    12288:KMrzy904r5tGzE0S2bZ9nhboI9Ud4QCqzU3dDGXh:lytltGzE0S2dDbA4Sw3dDGXh

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1