Extracted

Extracted

• • Target

    afc511d5ec9d811c758c7ced9617d8c125961ac033149585f7d964f453fb8487

  • Size

    530KB

  • MD5

    d27211471b1b3c95dfc859b90c1d5e78

  • SHA1

    62b2af550b38d4c1fead7819b56086ba5c47ff29

  • SHA256

    afc511d5ec9d811c758c7ced9617d8c125961ac033149585f7d964f453fb8487

  • SHA512

    875807f6b8d08d71c610eb2ba03c5968c6d8304b3788b4b632d15b37609f772c71722b5ba0850c72b53a2df349f08fb28426c3459b63957fe1a8de83ef2e5626

  • SSDEEP

    12288:OMr8y90yJHWnPMNvsYq3Uz+0h4I9uaqQLezkQ:+yxsYq3HrQuRzkQ

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1