Extracted

Extracted

• • Target

    89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

  • Size

    683KB

  • MD5

    84f5fb9df449978d540e1bfb39df93ed

  • SHA1

    3dc0d24b02920bd8ebccaea30d99029a47a50e4f

  • SHA256

    89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

  • SHA512

    163bc41995e60a761d2c2b9149057e6e23d262a5dd6a5f69477a5e84ded7a199aa8e33e831560fa76353a2330a149bc6959d7710abeac938e06442d67a4696ec

  • SSDEEP

    12288:5Mr5y90AqqAjVN2kYpdeudvQNr+vCb1YIpB1+qbwiS0n2UqEWntm6x:QybqquN2kYacvQt+v6b1BbM0n2UqEWnX

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1