Extracted

Extracted

• • Target

    139e7ddffabd1ca03c8e2977555657b2e8a44e73bdf11c1ea3bd12e3ee6282f2

  • Size

    697KB

  • MD5

    8323a8a66cf02e185e83aa1605aa7184

  • SHA1

    95aacbbcb06ecdaab2e3b55952ad51297f24688a

  • SHA256

    139e7ddffabd1ca03c8e2977555657b2e8a44e73bdf11c1ea3bd12e3ee6282f2

  • SHA512

    4093ce7948db190526005dc64a6fe8364889d185f9dddb03255b06a2b51b967b15f724284603422cef9b9ba2d49da4be4dd020cdaea37771fbbfdda11bdfe3e3

  • SSDEEP

    12288:KMrxy90LV+2szMFTopf8X/YWlLucjnJSKh+L6ZqGjUAxI9gTv4F:7yNzEopfolLucjJSmktGjtI9Mw

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1