Extracted

Extracted

• • Target

    3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e

  • Size

    658KB

  • MD5

    b2d74d841f0944e17c1bf90413f0edd4

  • SHA1

    9a5b5cfcce946941e12762615fe44b28304dd056

  • SHA256

    3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e

  • SHA512

    efdeb2205b1ff91e5ed1a3dd8e25b3f05b93952f7e1b768f2f990aa89b0c75cd54db7dadf0d5a1e30fc356d460536434c1ce140bba82fa03a9fbd7c92cc395f6

  • SSDEEP

    12288:HMrey90Ym/errM58OssoyyRGkjI+AZvbpftXEOa0o0jMOys2:tyTfQ5wGS5eEOTVGs2

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1