Extracted

Extracted

• • Target

    a1d38e260bb2a1350d436321b848b018e5f13a23539d7b891d81ce0a2764a32a

  • Size

    698KB

  • MD5

    c5e46b2511f227c84c8fe262b1ab3a15

  • SHA1

    d9be0be295b936d2193acf5c034082c40607a7c0

  • SHA256

    a1d38e260bb2a1350d436321b848b018e5f13a23539d7b891d81ce0a2764a32a

  • SHA512

    dbccc6171e62553dd6337cfecbce08bd497ad1403bd10aaa6f0bedb310dac1d7a153af54aaa5ed81dfcf4b1a21cbf3f09ae64ee8fd3a7241619213ef724f4626

  • SSDEEP

    12288:SMr7Cgy900xh9wxw0e9L85tR/N7F3NBB9QS3CE3dl69/10UKQW5xLPIEMdrnH6:VybKE0l7F9BB9wE3dl6QUKDPsa

  Score

  10^/10

  redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1