Extracted

Extracted

• • Target

    95b2242287e89f4cf17569fc7b0645be8a3c26bc4dac84e39657bfb984f14f32

  • Size

    659KB

  • MD5

    e8db902e73ef89a32af27d90f7c85036

  • SHA1

    add72b2ecbb83f5120fb4ff75a7c59debfb917b2

  • SHA256

    95b2242287e89f4cf17569fc7b0645be8a3c26bc4dac84e39657bfb984f14f32

  • SHA512

    23fa4d3d467b8ecbd8c65b2958c6122fbfbf48d6c1c34e96ac213c60543a37d442772b7b423cc8fcdd48b7a9d5c3d8b89367a010b96afbddb5b7036e8905a902

  • SSDEEP

    12288:bMryy90pSqfL5Kk2O+B8XulUAXxbKjoQoqBijir/FCSIi3:tyySj5+XulpkEQDf9gi3

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1