Extracted

Extracted

• • Target

    24eb37b3f59f7fe94f05bd7075e87ad0d6d6ebb371f82d32ce5f0566f65fc2a0

  • Size

    695KB

  • MD5

    a18584247783816894d230c8ad0611ba

  • SHA1

    49c5a1a9c0275a0560c6fb1d5f8adcfeeb6f1e81

  • SHA256

    24eb37b3f59f7fe94f05bd7075e87ad0d6d6ebb371f82d32ce5f0566f65fc2a0

  • SHA512

    3394132d7127a9ef044c91531a79cb8fed69f588155a6467c415065a5cc11a25ba82b75f12285d631aa5438250c4c7519cb5a0ddba24f4a551fba30d1ebc8dc5

  • SSDEEP

    12288:dMrVy90tlWO4viIiiTIaOXGCvmcr69/NOMuuxX+rVWwEwiUHX+FztJba+:Uy6Ht0Ea5cr6jOMlYnittb

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1