Extracted

Extracted

• • Target

    e33068f44ee80a25fca85c6f14b2b166ce68b112cf17f22fbf0a12cfba3d4c67

  • Size

    698KB

  • MD5

    11d68b0cc0fb38109e24b221a74c1583

  • SHA1

    d2c0d2b25e5d56dd14a403c3ab98e95eafb8bb54

  • SHA256

    e33068f44ee80a25fca85c6f14b2b166ce68b112cf17f22fbf0a12cfba3d4c67

  • SHA512

    ab496ee54f84f06d62f133bc2aed69eeb443949cd4605f78d5492ce411488fb35e3ef2390a3cda65ad89dd9cafa4c916b2e94990aff94229e067e185fc61d298

  • SSDEEP

    12288:oMrYy90iHwr4ZtlWgypZZqp/Yj3Vj0q7tklqL6fyGjgAxI9g0SU7cdODV:wy3QbgypZsm3Vj0q7tFnGjxI9Zr7cMR

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1