Extracted

Extracted

• • Target

    fb960acc460e431c0ed2b543136a5bb65f309ad7534471daba70659486ab04a8

  • Size

    680KB

  • MD5

    30f2e6d5355112355a99f4fda936dee9

  • SHA1

    7072fb45e5f4663372263aebb13d9ea4a62c34ee

  • SHA256

    fb960acc460e431c0ed2b543136a5bb65f309ad7534471daba70659486ab04a8

  • SHA512

    08cc42b98869de03cd3f95414661a2138d556740f51a57bfc17f44873e0d743bbf3aa0372dce91b08f092b35a83f2d4d3b1fe08d14ea78eef72e32dea8619141

  • SSDEEP

    12288:7mMzFXFWH+sb7gsOV4Fcie32MPCXBCL2y/EArnF7mUeqlBCKVO2Ri:f2HD26KieG1Xs/E6F7mJqlBCKHI

  Score

  10^/10

  redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1