Extracted

Extracted

• • Target

    9286a51986f01ddc51ae9a22faf44fd9cae9ac51729128eebaf6bc88aa61b9d3

  • Size

    685KB

  • MD5

    4aed380323be39efa99cf0031a23ee8f

  • SHA1

    382e85ab3d1cc20029b3a9c83ce6a411141b3588

  • SHA256

    9286a51986f01ddc51ae9a22faf44fd9cae9ac51729128eebaf6bc88aa61b9d3

  • SHA512

    d638229563809109ad789f33e6c233de3640b3d6c08c5c33b6c2b02040c3418a66eca301e484523c5e4001e094f6d5f25af64d3bac7208e92926580a3db58b43

  • SSDEEP

    12288:/Mrhy90sS/qD7X6TprZxtkOXrX4eXHhXE435qAebCld+lnMt:6yNEZE8rDXNEMqnSdl

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1