Extracted

Extracted

• • Target

    8b0e1b318fd8c42a8d5166ba988dd99a30ea957ba82d75a1b63793db7e6a583b

  • Size

    696KB

  • MD5

    da2d4d7dcf230745b606e2b264382113

  • SHA1

    80034c7b6083f71f4ecb7c7fa2340faf42e6ffb7

  • SHA256

    8b0e1b318fd8c42a8d5166ba988dd99a30ea957ba82d75a1b63793db7e6a583b

  • SHA512

    b0f7456afa7ad663d177c8cc19634aeab0c14df0fc5ec09d9f3137cc65ecd82b059fd51614df05e10c38bb59ed02587e55fd10143e7b95dae7a6df1af0a5f5b8

  • SSDEEP

    12288:JMrby90tNMS/YJOxQmy3NOmOWJN69/8/CE+zfyiaV3HFqgI3S:+yM+S/x6my9xJN6zdai4rIi

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1