Extracted

Extracted

• • Target

    9a3f328e5fbc44af7ecc4e98cf7260e13189d17e5140b080a0a1ae73bfc1b2af

  • Size

    696KB

  • MD5

    928e3fa99ac0ffa0f50680198028d2d7

  • SHA1

    15f634b336b0b23c898a25d313fbb96d1fbc79c8

  • SHA256

    9a3f328e5fbc44af7ecc4e98cf7260e13189d17e5140b080a0a1ae73bfc1b2af

  • SHA512

    c38807532413660f89205660a2d5bc1923fef9e2ed7748e0d84996d67c25c502037211c372df5658d15a4966bb8ba540281bf6ecf57370da76ab4a1adb0dd15a

  • SSDEEP

    12288:JMrhy90iLIONt3NBB9GS36Ehzl69/DZ1fvt6QW9OYnlsgghsk:wybLjt9BB9KEhzl6dfF6BnagAsk

  Score

  10^/10

  redlinerosnzazadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1