Extracted

Extracted

• • Target

    bafe8670bf72f430bd0a184e57c4c4a17b970ad14f28b30e2b64944bc9207cfe

  • Size

    686KB

  • MD5

    4d144fee9419277c7aace801b98d93ac

  • SHA1

    1b35ecb5fc900e2cce9a99930f8c76ad2c08c0e7

  • SHA256

    bafe8670bf72f430bd0a184e57c4c4a17b970ad14f28b30e2b64944bc9207cfe

  • SHA512

    cf8405d60fd7d89ab3711724ef364f991b928f0e29e26f607acb96a995eaacac03a04163157e6a4c57c5e2484d79b97abc24d040b161ef7ebe1aaead28e9c32d

  • SSDEEP

    12288:xMr4y908ab7N8P96mZJVSRepLItMUL8rO2gK4g/Nof9mdy:5yzu7Nc96GJVS5MULIO294g1okdy

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1