Extracted

Extracted

• • Target

    4acda04a34c97af68467794edbc79ecbcf7c325c274b2e9074b00871897f39fb

  • Size

    688KB

  • MD5

    7bee4ec98caa72521a943d4a8bc11b97

  • SHA1

    1a1902a00ac8bcc04f540bdb21b93e0ad0a330d8

  • SHA256

    4acda04a34c97af68467794edbc79ecbcf7c325c274b2e9074b00871897f39fb

  • SHA512

    94728afe4694ef54719a5856875bfa412cd01feaa090cb5129de7d325d80c691ca61c123e241e723bb820ac5fadecab8d27133e18b757a7f66c2eb107a58d795

  • SSDEEP

    12288:6MrUy90kML59cXPl3ABLA2/YTD06e1GnWDgmOcf55Ur:6yyLUOJgW1GnWycB5Ur

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1