Extracted

Extracted

• • Target

    7f27d7601ac0888baca3490ee40462700aea71b201a48b6f1847253ad922457e

  • Size

    534KB

  • MD5

    1856d5f98fe6a8bb1caba43bc0a20eb5

  • SHA1

    24cbe24e68dde4f25b15b845155ce0c6c486cfee

  • SHA256

    7f27d7601ac0888baca3490ee40462700aea71b201a48b6f1847253ad922457e

  • SHA512

    48047397cdd6da61c879d7502c2c63dde6e61354150e744942f46a348cbe3d1f1c87882a5038c215f5d7fc2ec79fe6ab28e68618a596f97f61bf3255c2148703

  • SSDEEP

    12288:VMrQy90StrtGoQ3aMNp52tLuzTbVW6Tu97mz5rOM:pydfGoQKSpeuz3VbTulmz5rOM

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1