Extracted

Extracted

• • Target

    fbc2841b5802640b50287bb50eb7dad767d86e746f9843292c414e996a812cfa

  • Size

    530KB

  • MD5

    31d9b4f28f11337f9a582e317ec07ac4

  • SHA1

    bbf881e49d61adc607d6c1279d3dfb378581c1e9

  • SHA256

    fbc2841b5802640b50287bb50eb7dad767d86e746f9843292c414e996a812cfa

  • SHA512

    3b215f61824230e14bd8716b95b7b5c1b326e377e66c75488052253e208199ba17eb3cf8eb584b7fd7061f22ad890d1fdcb30452cb9e302c8e5f1f4e107fef88

  • SSDEEP

    12288:nMrOy90/9cbdXV5m16m8asK8G0i/wf5KXa/3mOj00zNkS:py62b0n8BWkA0mDgSS

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1