Extracted

Extracted

• • Target

    fc421254213df5ee8771db7a54f45406681d68f44cdfbfb30df538638e46c44f

  • Size

    699KB

  • MD5

    e9247415d15c3bf0d0f456b94f66d279

  • SHA1

    f9a72e11626d26469a7a52ff95d3330867be003b

  • SHA256

    fc421254213df5ee8771db7a54f45406681d68f44cdfbfb30df538638e46c44f

  • SHA512

    52e2fd7f7b90f5ed0a68f2cfccf424d989c55cacc925882415ebf142ec5dc02ae0d681de4015995f0dd4bb2c55283f12e099a78fc4a87bf9e4a12ab0b8fc7ffa

  • SSDEEP

    12288:1MrHy90bFwQVr7Fw9Sl0mvwdeE5cIgxx+uWoN8/Fsqc2Ux6E:6yRIy4GOwjcI8xnO/FW2UX

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1