Extracted

Extracted

• • Target

    7bd1b1c9e0eabc6b9c8dbc551f95134f46e04d82dc5826f2128f3bdcd1ec8ffc

  • Size

    685KB

  • MD5

    d8c458369b51e3cce0c2b20bfb587a5e

  • SHA1

    c4accbd98879e9fd7cd82b371f8da7db62e4dc39

  • SHA256

    7bd1b1c9e0eabc6b9c8dbc551f95134f46e04d82dc5826f2128f3bdcd1ec8ffc

  • SHA512

    12ede21c1af83209b9eb060bf25e4497ab8fff4b55f338348a7297b6d19ddecddfaa1a94dc7330abdd8e0aac91419d60d6545ec0b1e699510f3a56b899b5c1fc

  • SSDEEP

    12288:LMrIy90u1g+njbkNzEC05CBbTlq7HzNRv4UYoHQCvfce1GnGOg5uf:jyBrnkNzEFqOJ5H1fJ1GnG0f

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1