Extracted

Extracted

• • Target

    572785891f15dcb8f8ab5ec235d881837e3e348b88e4e31328fc21d7b0aecf1b

  • Size

    685KB

  • MD5

    0f033874839920b9926df9279dc9b127

  • SHA1

    c41557973e921e3ad41499ab60d4d1d0e5e13c08

  • SHA256

    572785891f15dcb8f8ab5ec235d881837e3e348b88e4e31328fc21d7b0aecf1b

  • SHA512

    855b599d6e078c3f1a80d347e7785064a6ec6c833221c548cd76bc5476456cf5cbb672e2ce96e2e8c98ba9391baa039a84c5287b6e8400922705f347a3d2caca

  • SSDEEP

    12288:zMr7y90GFPxEriPnAAdRT68Hd3ZmDLf45kN1oXUrE1Uclw8AkYwsj7/:Ay9tBPRT6MRZmDlN1fcUffkK

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1