Extracted

Extracted

• • Target

    b7d3b1698d5c494c542a8d7c4a2bc5a1cdf30e28c5a093ecb72617ec4917433a

  • Size

    671KB

  • MD5

    901175ddc15e4f6cb05d4b051c5fc35d

  • SHA1

    f39659168cf914d8d35a3063b4d5ecbe064b3c5d

  • SHA256

    b7d3b1698d5c494c542a8d7c4a2bc5a1cdf30e28c5a093ecb72617ec4917433a

  • SHA512

    8275efddc6e30e4e4e9242020972b71de37dea91ed920b0420b2ff70d41ee1fba4464b48df5dbe2aef62997399f218771a5290fae977e728050f067063298713

  • SSDEEP

    12288:sMruy90BTfERMXOULtc0fg/sPIGV3l52cjsR3Lqfv1dqgflZU:ay0E2ntc0fl5UcgR3GftYg9ZU

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1