Extracted

Extracted

• • Target

    f21da8b6c88b0afef96c05010d10d204f2897958bf9a0c1711e0d6170afae601

  • Size

    531KB

  • MD5

    1a14ccde94897499deea2a69c473fb01

  • SHA1

    430809095604e7b0ed005f8764171132b7e409a0

  • SHA256

    f21da8b6c88b0afef96c05010d10d204f2897958bf9a0c1711e0d6170afae601

  • SHA512

    9b5080e831e9ac1d3d13cd0101802b6a147cc6c4e4af3738e76b357377b23ee7412222776fe3d70bab56db548b40ce3436ebcded55cf44f7a65929e4a2990829

  • SSDEEP

    12288:iMrIy90NQwkINmGg3NTRG7IF1ryudvJyqf5KXa/wm1blWnlCqFOrAIQx:WyOkINeRG7IF9x3Arm1bElCMgG

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1