Extracted

Extracted

• • Target

    18c8106040df086ceae6d8c5a9c37ebef4cbc751df8511074b1cb89722c9cd85

  • Size

    530KB

  • MD5

    a7aa0da9b0d5f4f9ae4422bedfb85ff2

  • SHA1

    ffaa2e1b47508b0403a5ac9e35fda09dfb3927a4

  • SHA256

    18c8106040df086ceae6d8c5a9c37ebef4cbc751df8511074b1cb89722c9cd85

  • SHA512

    6b34351acd4e3e14b3e53bd57eceae340318c7e3dc44d73e2b7c76b5daddd3b93b082018ac28bd5de8ce6fff503c611cf89aba3610dd0d85ad4218a8220079e9

  • SSDEEP

    12288:KMrZy90m2ig/f+demCgtjPehT9Aijv5VnJdF/oA:/yc+Bptu9AijBVuA

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1