Extracted

Extracted

• • Target

    2c909dd5ea943f13722773c2b5e21ca86282117726bb130c6bff627a108671a6

  • Size

    661KB

  • MD5

    b324040a01dd65f3bb1bc2cb6c962dbe

  • SHA1

    395eec292500b693a5849c0dc003e204eba22052

  • SHA256

    2c909dd5ea943f13722773c2b5e21ca86282117726bb130c6bff627a108671a6

  • SHA512

    bc8bde8abb6b0868e7122ca59887598a343b496b4a9e581de7839162a391f53ad1086c1c08c387046f4df8231709f0c3ad09ff9d22534cbd3994db6a88d389a7

  • SSDEEP

    12288:EMrey9073t1SjwVJw6p57U2RNzdvk5CNj//f6KXa/TmBRcrR7:qygL23w5gkvk5CNjvP0mBRgR7

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1