Extracted

Extracted

• • Target

    f8bd7747c3668750ccaaa0a98766df8b094f3d07c9b1e9c3a30eace58fa4ebcb

  • Size

    658KB

  • MD5

    fb2b21384faf7980a9e565cd7d025ef4

  • SHA1

    406ebac6eb5fa1b90e9a44806b8288793a7d043b

  • SHA256

    f8bd7747c3668750ccaaa0a98766df8b094f3d07c9b1e9c3a30eace58fa4ebcb

  • SHA512

    d09901a59c7d02033431f81e139beab90b03b9fedd4eeb9f5817c1a5c27377692c0b5b65e0f92ca1f8be170292b4302a2d7a21bfa74dc95736a3477865c2fd34

  • SSDEEP

    12288:BMrKy90sicL5IWNqNF/+9MwBdDrUCWnR4IcuJ4MLZqueW:nyKjWNqb+9TDrUCWnyNumy

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1