Extracted

Extracted

• • Target

    8db813bdace2b9bf0c4407bb90bedd3ad9b88d969dcd2b3d0cdf76533b0da457

  • Size

    696KB

  • MD5

    4082d95eeaff939a6efbc2e31323d666

  • SHA1

    dfb0d5aeebdd09a25e51f8a2749df35ab433ff62

  • SHA256

    8db813bdace2b9bf0c4407bb90bedd3ad9b88d969dcd2b3d0cdf76533b0da457

  • SHA512

    d742f8a8f1a2c20d9fc3f17c851170028bf95c8b2427539728d8d72fcc38ea44a107578155c6209bab084321f7435888c47a0398d4f80bd6048d0af458026e1a

  • SSDEEP

    12288:aMrJy90Q/JCjcn2H3pLl/MqGd4aDz2WhlQobiwFVj5eZ6Le2fk:DyMjb3pLFMqGd4OyWhZbiwFje4S

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1