Extracted

Extracted

• • Target

    b8215f08dec82b73252d685c6a95f1cb525ecece88a58cb0d4030ce3e36c5d0d

  • Size

    672KB

  • MD5

    f1589264d15217a47bf687e3ac998553

  • SHA1

    63f046e3fa0491c2568b09a80b180dfdcce2b2a0

  • SHA256

    b8215f08dec82b73252d685c6a95f1cb525ecece88a58cb0d4030ce3e36c5d0d

  • SHA512

    48bc541c29d869e5a72a2c4e061bf0976773b1cd1cda33dd8ed609f6b8edbaa9e6f78655e262016dba5947319c567e79188adb78e4fb6fe674cee71ec6249d07

  • SSDEEP

    12288:MMroy903xbBOIoq9kD7JKyaxMPam3V2xVDD/O9m+8Su5mUz3:cyJquJKyaWSmlMKm+hU3

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1