Extracted

Extracted

• • Target

    dab95e243c1c0bdff357ec1ff8d6582cbebf0dfb1dfdf73e2931e51b01bb5773

  • Size

    662KB

  • MD5

    8f4ff9875e329d89daf2dc1864897a21

  • SHA1

    80004e93fcdce24ad87567543cd8a83ee155d9b0

  • SHA256

    dab95e243c1c0bdff357ec1ff8d6582cbebf0dfb1dfdf73e2931e51b01bb5773

  • SHA512

    b775f44b8c83ba3649ab81a40d3e3e133c888835b5c044d1b6dbc665c74a0a558691fc4398c0ca2f132c84ad419e321927350aa13f090b031451cf72573a4f5b

  • SSDEEP

    12288:5Mrgy90/TjrtkkUP6JtUi1juz77bM28rzn8/fpKXa/Im2qatBtv2:ly+Tjr7mIaipW743rznSQbm2qKtv2

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1