Extracted

Extracted

• • Target

    460e95d846336532cb386801a4669d95d7607ad56b027de247d60e2e17106916

  • Size

    695KB

  • MD5

    fda58c390139fae7dd07ee5877db73a0

  • SHA1

    f573adf0056b804a856ec6399e075d7cccdd5847

  • SHA256

    460e95d846336532cb386801a4669d95d7607ad56b027de247d60e2e17106916

  • SHA512

    f76ca33c499803c131fa84f94bf0676ecfd1bfb13f15d3e7673082bf703706bac614ab1d2126b983e6f5e0eb178df928d1ea01de0e14888e61a6396d1aca29e7

  • SSDEEP

    12288:5Mr7y90Ons+dRvezUboHnelO0/6s4ZjN81U4XguJZ2BO5Ek/a/mK6LG:6y9sYRezWYelO0/6s4Zh81U4XHb/Imc

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1