Extracted

Extracted

• • Target

    85cff0e6d9a5d8d15f587109714283b46a352cf3cb96bc027a635bbc800a5f5a

  • Size

    530KB

  • MD5

    01c83ac04fa104185716363a56582821

  • SHA1

    7ff01036dbcbc9496578265625fb662fd99a59e8

  • SHA256

    85cff0e6d9a5d8d15f587109714283b46a352cf3cb96bc027a635bbc800a5f5a

  • SHA512

    ddb05b45f2be33b96673e6f66646d7ed767a6186218a6cfaca9e9fcf187bc92fed20172c53deb861c5fa977f6d752871d85d8df81f5a7f416760c7354aa53bb8

  • SSDEEP

    12288:+Mrky90/N19cO40N1pHJ3FNC16ad+E8qxCyMrM/naM2:+ys1KOt1phmwad+E8gnSM2

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1