Extracted

Extracted

• • Target

    b3d6794b902ef92e471ec7da72585c71478d68ca22e36ebb31143c2b98cd4476

  • Size

    697KB

  • MD5

    39a46897b4d88b982c886ac7307a5bcb

  • SHA1

    c4fdd6f6df0bfb76848868d7f3de1c77e65c2f0b

  • SHA256

    b3d6794b902ef92e471ec7da72585c71478d68ca22e36ebb31143c2b98cd4476

  • SHA512

    7e45aa31e96f975a918efdae5eca6e4f07fdd977dce061564ec2138d5afa89f886f0a211e34328a0a6af870cb578d12cabe554caa0a4e7bf2464fd417c1f8398

  • SSDEEP

    12288:tMr7y90Lj/MSIrU0mK2FFC+iG1Hv8tWzNkdIjL6L3GjuAxI9gsFE+IL:KyAj/MmK4bNlv8a3KGjDI9raL

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1