Extracted

Extracted

• • Target

    d1f7b43fd6e3c2e984e7eb1755e2ecf65c1dad7ee1912c8d995d05aba37cc3f5

  • Size

    685KB

  • MD5

    a56c01b5927e96f9497ac7fe839705cd

  • SHA1

    b97ff6038f3ede6231908b55559c8263a9c7a308

  • SHA256

    d1f7b43fd6e3c2e984e7eb1755e2ecf65c1dad7ee1912c8d995d05aba37cc3f5

  • SHA512

    085fe10d0cefff2e19c5234f8ae1f873d7c17210c5436e66de0d3557515f94e9948118608458157d3ffa654ecf49c063012ddb2cce35e7b635d3ff9a89c6fee7

  • SSDEEP

    12288:gMrwy90LNUaBdznwZkjO/HfIkRlON3OfvaHhU+43FDz0JbpP/kyD:Ay8egdFO//I8lOJOXOa+s/c1nt

  Score

  10^/10

  redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1