Extracted

Extracted

• • Target

    44761486f16c6b23c2355ad51a12c6ec7d47bb275ad97ccb2b5a1d2e9bdaff1b

  • Size

    695KB

  • MD5

    f4caba4ba16ebb7df6b5f545416c7400

  • SHA1

    12491a9be241baaefb6e0d43ee6a80fbbf1fd74a

  • SHA256

    44761486f16c6b23c2355ad51a12c6ec7d47bb275ad97ccb2b5a1d2e9bdaff1b

  • SHA512

    4c099b545fa9ef51cf03401b1b40eee82b8958d81c74c696ef64d4e5a4fa26ff08330a86d7c43fbf2543bef8dc1d5417e0d66b51528d51e44657f3f196d10b7d

  • SSDEEP

    12288:BMrty90DXJ/uBS1Ivs9+M5+FUU9aDzJwF9nnhwVJnEZ5F5W8Iazd4L7R:0yfRM5oUU9O1U9nn2DER5W8ISux

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1